CN109417701B

CN109417701B - Method and apparatus for accessing a cellular network to obtain a SIM profile

Info

Publication number: CN109417701B
Application number: CN201780040502.9A
Authority: CN
Inventors: 白令教; 李德基; 朴锺汉; 李慧远
Original assignee: Samsung Electronics Co Ltd
Current assignee: Samsung Electronics Co Ltd
Priority date: 2016-07-05
Filing date: 2017-07-05
Publication date: 2022-04-08
Anticipated expiration: 2037-07-05
Also published as: KR20180005134A; CN109417701A; EP3449648C0; EP3449648A4; WO2018008972A1; US20200296574A1; KR102405409B1; EP3449648A1; US20180014178A1; US20230164540A1; CN114615655B; EP3449648B1; US10645566B2; CN114615655A

Abstract

The present disclosure relates to a communication technology combining a 5G communication system for supporting a higher data rate than a super 4G system with an IoT technology, and a system thereof. The present disclosure may be applied to smart services such as smart homes, smart buildings, smart cities, smart cars or networked cars, healthcare, digital education, retail, security, and security-related services based on 5G communication technology and IoT-related technology. A method is disclosed for causing the cellular network itself to receive a configuration of a SIM profile to make it possible to use normal cellular network services.

Description

Method and apparatus for accessing a cellular network to obtain a SIM profile

Technical Field

If the terminal does not have a Subscriber Identity Module (SIM) profile, such as a public market oriented terminal installed with an embedded SIM, it is necessary for the terminal to download the SIM profile (SIM profile) by attaching to an eSIM server, for example, a Subscription Manager Data Preparation plus (SM-DP +; Subscription Manager Data Preparation plus) or a Subscription Manager Discovery Service (SM-DS; Subscription Manager Discovery Service), in order to receive normal cellular Network services provided by a Mobile Network Operator (MNO; Mobile Network Operator). However, a scheme for providing a Packet Data Network (PDN) connection or a Packet Data Unit (PDU) connection to a terminal to connect to an eSIM server through a cellular Network is required.

Furthermore, if a terminal, such as a public market oriented terminal installed with an embedded subscriber identity module (eSIM) or a terminal for IoT, does not have a Subscriber Identity Module (SIM) profile, it is necessary for the terminal to download the SIM profile by attaching to an eSIM server, such as subscription manager data preparation + (SM-DP +) or subscription manager discovery service (SM-DS), in order to receive normal cellular network services provided by a Mobile Network Operator (MNO). For example, the terminal may attach to SM-DP +, which is a provisioning server (provisioning server) storing the SIM profile, in order to download the SIM profile. Further, the terminal may attach to an SM-DS, which is a server for searching address information of SM-DP + (i.e., a configuration server storing a SIM profile of a specific terminal), to find out in which SM-DS the SIM profile of the terminal is stored, and then may attach to the found SM-DP + to download the SIM profile. However, a scheme for providing a Packet Data Network (PDN) connection or a Packet Data Unit (PDU) connection to the terminal to connect to the eSIM server through the cellular network is required.

Specifically, in the case of a terminal without a SIM profile, a user who has subscribed to a plan of a specific communication company may receive a configuration of an assigned SIM profile (provisioning), or in some cases, a user who has not subscribed to any communication company may select and subscribe to a plan of a specific communication company through the start-up of a terminal to receive a configuration of a SIM profile. There is a need for a technique that enables the cellular network to recognize such a situation and smoothly provide the configuration of the SIM profile to the terminal.

Background

In order to meet the increasing demand for wireless data services since the deployment of 4G communication systems, efforts are being made to develop improved 5G or quasi-5G communication systems. Accordingly, the 5G or quasi-5G communication system is also referred to as a "super 4G network" or a "post-LTE system". The 5G communication system is considered to be implemented in a higher frequency (millimeter wave) band (e.g., 60GHz band) in order to achieve a higher data rate. In order to reduce propagation loss of radio waves and increase transmission distance, beam forming, massive multiple-input multiple-output (MIMO), Full-Dimensional MIMO (FD-MIMO), array antenna, analog beam forming, large antenna technology are being studied in a 5G communication system. In addition, in the 5G communication system, in order to improve a system Network, technologies based on advanced small cells, a cloud Radio Access Network (RAN), an ultra-dense Network, device-to-device (D2D) communication, a wireless backhaul, a mobile Network, cooperative communication, Coordinated Multi-point (CoMP), receiver interference cancellation, and the like are being developed. In the 5G system, hybrid FSK and QAM Modulation (FQAM; FSK and QAM Modulation) and Sliding Window Superposition Coding (SWSC) are being developed as Advanced Coding Modulation (ACM), and filter bank multi-carrier (FBMC; filter bank multi-carrier), non-orthogonal multiple access (NOMA; non-orthogonal multiple access), and sparse code multiple access (SCMA; sparse code multiple access) are being developed as advanced access technologies.

The Internet, which is a human-centric connectivity network of information generated and consumed by humans, is currently evolving into the Internet of Things (IoT) where distributed entities (e.g., Things) exchange and process information without human intervention. Meanwhile, Internet of Everything (IoE) in which an IoT technology and a big data processing technology are combined through connection with a cloud server has also appeared. Since IoT implementations require technical elements such as "sensing technology", "wired/wireless Communication and network infrastructure", "service interface technology", and "security technology", sensor networks, Machine-to-Machine (M2M; Machine-to-Machine) Communication, Machine Type Communication (MTC; Machine Type Communication), and the like have recently been studied. Such IoT environments can provide intelligent internet technology services that create new value for human life by collecting and analyzing data generated among connected things. IoT may be applied in a variety of fields including smart homes, smart buildings, smart cities, smart cars or networked cars, smart grids, healthcare, smart appliances, and advanced medical services through convergence and combination of existing Information Technology (IT) with various industrial applications.

Accordingly, various efforts are underway to apply the 5G communication system to the IoT network. For example, communications such as sensor networks, Machine Type Communication (MTC), and machine-to-machine (M2M) may be implemented through beamforming, MIMO, and array antennas. By applying a cloud Radio Access Network (RAN) as described above, big data processing technology can also be seen as an example of convergence between 5G technology and IoT technology.

Disclosure of Invention

Technical problem

In an aspect of the present disclosure, if a terminal does not have a SIM profile, such as an open market-oriented terminal installed with an eSIM, it is necessary for the terminal to download the SIM profile by attaching to an eSIM server (e.g., SM-DP + or SM-DS) in order to receive normal cellular network services. However, a scheme for providing a PDN connection or a PDU connection to the terminal to connect to the eSIM server through the cellular network is required. In the related art, a terminal without a SIM profile may obtain a connection through a Wi-Fi network or a network sharing (tethering) method. However, in the case of a connection where a connection is not made in advance, the terminal cannot have a connection. Further, in the case where a terminal manufacturer sells a terminal after pre-storing a configuration profile provided by the manufacturer in an eSIM, there may be a method for obtaining a limited connection through the configuration profile in a cellular network, downloading a SIM profile from an eSIM server through the obtained connection, and receiving a cellular network service through the downloaded SIM profile. However, this method may cause a problem in that the price of the terminal rises.

An aspect of the present disclosure provides a scheme for a terminal, which installs an eSIM without a SIM profile, to obtain a PDN connection or a PDU connection through a cellular network.

Further, in an aspect of the present disclosure, if the terminal does not have a SIM profile, such as an open market-oriented terminal or an IoT-oriented terminal in which an eSIM is installed, it is necessary for the terminal to download the SIM profile by attaching to an eSIM server (e.g., SM-DP + or SM-DS) in order to receive normal cellular network services. For example, the terminal may attach to SM-DP +, which is a configuration server storing SIM profiles, in order to download the SIM profiles. Further, the terminal may attach to an SM-DS, which is a server for searching address information of SM-DP + (i.e., a configuration server storing a SIM profile of a specific terminal), to find out in which SM-DS the SIM profile of the terminal is stored, and then may attach to the found SM-DP + to download the SIM profile. However, a scheme for providing a PDN connection or a PDU connection to connect to the eSIM server through a cellular network is required. In the related art, a terminal without a SIM profile may obtain a connection through a Wi-Fi network or a network sharing (tethering) method. However, in the case of a connection where a connection is not made in advance, the terminal cannot have a connection. Further, in the case where a terminal manufacturer sells a terminal after pre-storing a configuration profile provided by the manufacturer in an eSIM, there may be a method for obtaining a limited connection through the configuration profile in a cellular network, downloading a SIM profile from an eSIM server through the obtained connection, and receiving a cellular network service through the downloaded SIM profile. However, this method may cause a problem in that the price of the terminal rises.

In particular, for a case where a user who has subscribed to a plan of a specific carrier receives a configuration of an already-allocated SIM profile or a case where a user who has not subscribed to any carrier selects and subscribes to a plan of a specific carrier by the activation of a terminal to receive a configuration of a SIM profile, an aspect of the present disclosure provides a scheme for enabling a cellular network to recognize a situation and smoothly provide the configuration of a SIM profile to a terminal without an SI profile.

Solution to the problem

According to an aspect of the present disclosure, a method for a terminal to download a profile includes: checking whether a profile of a Universal Integrated Circulation Card (UICC) of the terminal exists; transmitting an attach request message including identification information of the UICC to a Public Land Mobile Network (PLMN) selected by the terminal if the profile does not exist; and receiving an attach response message.

According to another aspect of the present disclosure, a method for a Mobility Management Entity (MME) to support profile downloading comprises: receiving an attach request message including identification information of a Universal Integrated Circulation Card (UICC) of a terminal from the terminal; sending a message to an Equipment Identity Register (EIR) requesting to check whether to grant an attachment of the UICC with respect to a Public Land Mobile Network (PLMN) selected by the terminal; receiving, from the EIR, a message including information regarding whether to grant attachment of the UICC; and sending an attach response message to the terminal based on the information on whether the attachment of the UICC is permitted.

The invention has the advantages of

According to aspects of the present disclosure, in the related art, a terminal without a SIM profile may obtain a connection through a Wi-Fi network or a network sharing method. However, in the case of a connection where a connection is not made in advance, the terminal cannot have a connection. Further, in the case where a terminal manufacturer sells a terminal after pre-storing a configuration profile provided by the manufacturer in an eSIM, there may be a method for obtaining a limited connection through the configuration profile in a cellular network, downloading a SIM profile from an eSIM server through the obtained connection, and receiving a cellular network service through the downloaded SIM profile. However, this method may cause a problem in that the price of the terminal rises. According to aspects of the present disclosure, since a terminal in which an eSIM without a SIM profile is installed can obtain a PDN connection or a PDU connection through a cellular network for SIM profile configuration (SIM profile configuration), the SIM profile configuration can be received through the cellular network itself without using other connection, and thus normal cellular network service can be used.

Further, according to aspects of the present disclosure, in the related art, a terminal without a SIM profile may obtain a connection through a Wi-Fi network or a network sharing method. However, in the case of a connection where a connection is not made in advance, the terminal cannot have a connection. Further, in the case where a terminal manufacturer sells a terminal after pre-storing a configuration profile provided by the manufacturer in an eSIM, there may be a method for obtaining a limited connection through the configuration profile in a cellular network, downloading a SIM profile from an eSIM server through the obtained connection, and receiving a cellular network service through the downloaded SIM profile. However, this method may cause a problem in that the price of the terminal rises. In contrast, according to aspects of the present disclosure, since a terminal in which an eSIM without a SIM profile is installed can obtain a PDN connection or a PDU connection through a cellular network for SIM profile configuration, the SIM profile configuration can be received through the cellular network itself without using other connections, and thus normal cellular network services can be used.

Drawings

Fig. 1a is a diagram showing the structure of a network in which a terminal installed with an eSIM performs SIM profile configuration;

fig. 1ba and 1bb are diagrams showing a network connection scheme for a terminal installed with an eSIM to perform initial configuration;

fig. 1ca and 1cb are diagrams showing a network connection scheme for a terminal installed with an eSIM to perform initial configuration;

fig. 1da to 1dc are diagrams illustrating a network connection scheme for a terminal installed with an eSIM to perform initial configuration in consideration of ID security;

fig. 2a is a diagram showing the structure of a network in which a terminal installed with an eSIM performs SIM profile configuration;

fig. 2ba to 2be are diagrams showing a network connection scheme for a terminal installed with an eSIM to perform remote configuration by determining subscription/non-subscription in an EAP procedure;

fig. 2ca to 2cd are diagrams showing a network connection scheme for a terminal installed with an eSIM to perform initial configuration through an EAP procedure and a separate subscription/unsubscribe determination procedure;

fig. 2da to 2dd are diagrams illustrating a network connection scheme for a terminal installed with an eSIM to subscribe and perform provisioning by determining whether to permit an eUICC in an EAP procedure;

fig. 2ea to 2ed are diagrams illustrating a detailed network connection scheme for a terminal installed with an eSIM to subscribe and perform provisioning by determining whether to permit the eUICC in an EAP procedure;

fig. 2fa to 2fd are diagrams illustrating a network connection scheme for subscribing a terminal installed with an eSIM and performing provisioning by determining whether to permit the eUICC separately from an EAP procedure;

fig. 2ga to 2gd are diagrams illustrating a detailed network connection scheme for subscribing to a terminal installed with an eSIM and performing provisioning by determining whether to permit the eUICC separately from an EAP procedure;

fig. 3a is a diagram illustrating a structure of a terminal according to an embodiment of the present disclosure;

fig. 3b is a diagram illustrating the structure of an MME according to an embodiment of the present disclosure;

fig. 3c is a diagram illustrating a structure of a GW according to an embodiment of the present disclosure; and

fig. 3d is a diagram illustrating the structure of an UP function according to an embodiment of the present disclosure.

Detailed Description

Hereinafter, embodiments of the present disclosure will be described in detail with reference to the accompanying drawings. In the following description of the present disclosure, well-known functions or configurations incorporated herein are not described in detail in order to not obscure the subject matter of the present disclosure with unnecessary detail. Further, terms to be described later are terms defined in the present disclosure in consideration of their functions, but may be different according to intentions or customs of users and operators. Therefore, they should be defined on the basis of the contents of the complete description of the present disclosure.

Aspects and features of the present disclosure and methods for implementing the same will become apparent by reference to the embodiments to be described in detail in connection with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but may be embodied in various forms. The matters defined in the description, such as detailed construction and elements, are nothing but specific details provided to assist those of ordinary skill in the art in a comprehensive understanding of the disclosure, and the disclosure is defined only within the scope of the appended claims. Throughout the description of the present disclosure, like reference numerals are used for like elements in the various figures.

< first embodiment >

Fig. 1a is a diagram showing the structure of a network in which a terminal installed with an eSIM performs SIM profile configuration.

Referring to fig. 1a, a terminal (or User Equipment UE) mounts an embedded Universal Integrated circuit Card (eUICC) in order to use an eSIM. After a terminal secures a connection by connecting to a packet core Network, the eUICC receives a configuration of a SIM profile corresponding to a Mobile Network Operator (MNO) that will use a data service from an eSIM server (e.g., SM-DP + server). If the terminal or eUICC does not have the address of the SM-DP + server, the terminal receives the configuration of the SIM profile through a connection with the SM-DP + server after obtaining the address of the appropriate SM-DP + server through a connection with the SM-DS server, which is another eSIM server.

The Packet core network to which the terminal connects to ensure connection may be, for example, a cellular network providing data communication, and may be, for example, an Evolved Packet System (EPS) providing an LTE network service or a 5G network. There may be an MM functional entity responsible for mobility management of a terminal and an SM functional entity responsible for session management, and through the functional entities, signaling messages may be processed. In case of EPS, the MME acts as MM functional entity and SM functional entity. Further, an Equipment Identity Register (EIR) is an entity that determines whether a terminal in a network is a permitted terminal by its IMEI, and in the present disclosure, an EIR is defined as an entity that can determine whether the eUICC is a permitted eUICC with respect to an eUICC ID. As an authentication server for encrypted communication with a terminal or eUICC, for example, there is an AAA server, and if encryption is not performed in the process of connecting to a packet core network, the AAA server is not used. Although not shown in fig. 1a, the system may include a base station, and the terminal and the MM or the terminal and the MME may transmit and receive signals, information, data, and messages through the base station.

Fig. 1ba and 1bb are diagrams illustrating a network connection scheme for a terminal installed with an eSIM to perform initial provisioning (initialization provisioning) according to an embodiment of the present disclosure. Hereinafter, fig. 1ba and 1bb are generally referred to as fig. 1 b.

Referring to fig. 1b, in an embodiment of the present disclosure, there is shown: a procedure of obtaining a connection by connecting to a cellular network, receiving a configuration (provisioning) of a SIM profile through an eSIM server, and performing a connection with the network using the downloaded SIM profile.

In the activated state, the terminal 1b-100 checks a SIM profile, and if the SIM profile does not exist, the terminal recognizes the necessity of initial configuration and transfers a list of available Public Land Mobile Networks (PLMNs) to an application of the terminal or an entity (1b-001) responsible for the initial configuration based on the list of PLMNs sensed through cell search.

The terminal 1b-100 may select a PLMN to connect to for initial configuration (1b-002) based on the transferred PLMN list. The selection of the PLMN may be performed by a selection input of the user or in a priority order according to a specific priority rule in the terminal. For example, in the case of a smartphone that facilitates user input, the initial configuration application presents a list of PLMNs that may be selected through the UI, and the user may select the PLMN through which the user wishes to receive the configuration. As another method, if it is difficult to make user input, for example, if a communication network service provider to be used is determined later after an IoT service provider purchases an IoT directed terminal, and thus there is no information about the communication network service provider in the terminal, a PLMN corresponding to the highest priority, such as a PLMN having the highest signal strength among available PLMNs, may be selected according to a priority rule of the terminal itself.

The terminal 1b-100 requests a network connection through the PLMN selected in the above procedure while transmitting an attach request to the MME 1 b-200. In this case, through the attach request message, it can be known that the attach type is for initial configuration (1 b-003). For example, "attach type ═ initial configuration" may be used. In this case, the attach request message may include an identification of the terminal 1b-100, for example, two or one of an International Mobile Station Equipment identification (IMEI) or an eUICC identification (e.g., eUICC ID or eID). Further, the attach request message may include two or one of an address of an SM-DS server and an address of an SM-DP + server to be connected to the terminal.

The MME 1b-200 sends a request message to the EIR 1b-300 to determine whether the terminal sending the attach request is a terminal admitted in the corresponding PLMN or whether the eUICC used by the terminal is an admitted eUICC. The request message may include at least one of an IMEI and an eUICC ID, and may request to check whether the ID is granted with respect to each identifier or both identifiers (1 b-004).

The EIR 1b-300 checks whether the terminal or the eUICC is a connection-permitted terminal or a connection-permitted eUICC based on the information received from the MME 1b-200 (1 b-005). The EIR 1b-300 may determine whether the IMEI or eUICC ID is permitted in the following manner: if the sent ID is in a blacklist of IMEI or eUICC IDs managed to prevent managed inferiority or theft in the corresponding service provider network or to prevent online opening, then network connection is denied. As another method, the network connection is permitted only if the transmitted ID is included in a white list of IMEI or EUICC IDs of the terminal, which can be specifically permitted to be opened online by the corresponding service provider. In case that the terminal manufacturer, which has manufactured the IoT terminal, provides information on the IMEI or the eUICC ID to the IoT service provider without providing a network open to the IoT service provider, and the IoT service provider subsequently signs up for using the network of the communication network service provider, the information on the IMEI or the eUICC ID received from the terminal manufacturer is transferred to the communication network service provider. The communication network service provider may store a white list in the EIR 1b-300 based on the communicated information and may grant attachment only with respect to the terminal to which the IMEI or eUICC ID is to be subscribed, by checking by the EIR whether the IMEI, eUICC ID or both are permitted IDs with respect to all terminals that sent an attach request for the initial configuration.

The EIR 1b-300 may send information indicating whether the connection of the terminal 1b-100 or the eUICC is permitted or not to the MME 1b-200 (1 b-006).

If the information received from EIR 1b-300 indicates that the connection is not permitted, then MME 1b-200 may send an attach reject message to terminal 1b-100 to reject the network connection (1 b-007). In this case, the rejection reason included in the rejection message may include that the eUICC ID in the PLMN does not match, the IMEI in the PLMN does not match, the eUICC ID is not available in the PLMN, and the IMEI is not available in the PLMN.

Upon receiving the attach reject message, the terminal 1b-100 may store the ID of the corresponding PLMN in an initially configured forbidden PLMN list, and may reselect a PLMN among available PLMNs (1 b-008). In this case, PLMNs included in the initially configured forbidden PLMN list are excluded from the available PLMN list. The selection of the PLMN is performed in the same way as 1b-002 and the terminal 1b-100 performs the attach request procedure again for initial configuration.

On the other hand, if the EIR 1b-300 notifies the MME 1b-200 that the connection of the terminal 1b-100 has been granted (1b-006), the MME 1b-200 omits the authentication/authorization procedure for security and selects a GW for initial configuration. That is, in the embodiment of the present disclosure, since the attach procedure is an attach procedure for configuration, it is newly proposed for the MMEs 1b-200 to omit the authentication/authorization procedure. At operation 1b-003, the terminal 1b-100 can append the PDN connection request on the attach request message, and even if the PDN connection request is not delivered together if the access type of the attach request message is for initial configuration, the MME 1b-200 selects the GW 1b-400 for performing the initial configuration and delivers a create session request to the GW 1b-400 to request the GW to make the PDN connection (1 b-010). In this case, if the GW for initial configuration is not designated to function as a separate entity in the network, the create session request includes an indication that the initial configuration can be notified. Further, the create session request may include the address of the SM-DS server or the address of the SM-DP + server received from the terminal 1 b-100.

On the other hand, if it is recognized that the create session request is for initial configuration, the GW 1b-400 that received the create session request may allocate an IP address and may operate to generate a default EPS bearer context. In this case, the GW generates a Traffic Flow Template (TFT) in a default EPS bearer so that the terminal 1b-100 can use it only for the purpose of initially configured Traffic, and configures an uplink/downlink packet filter so that communication becomes possible only if an address of an eSIM server (e.g., SM-DP + server or SM-DS server) is included as a target/source IP address (1 b-011). In configuring the uplink/downlink packet filter, an IP address to be used for specific filtering may be determined based on an address of an SM-DS server or an address of an SM-DP + server received from the terminal 1b-100, or an address served by the terminal 1b-100 may be used for authorization.

The GW 1b-400 may send a create session response message to the MME 1 b-200. The create session response message may include a TFT that includes an uplink/downlink packet filter (1b-012) for the default EPS bearer.

The MME 1b-200 may include the received TFT (1b-013) in the activate default EPS bearer context request message. The MME 1b-200 may communicate an activate default EPS bearer context request message to the terminal 1b-100 together with an attach accept message (1 b-014).

The terminal 1b-100 may communicate an attach complete message to the MME 1b-200 and at this point it may communicate together an activate default EPS bearer context accept message (1 b-015). Thereafter, the terminal 1b-100 can establish a PDN connection (1b-016) with the GW1 b-400.

Thereafter, the terminal 1b-100 can attach to the eSIM server 1b-500 using the obtained connection to receive the configuration of the SIM profile (1 b-017). If the SM-DS address exists in the packet filter configured in the TFT but the SM-DP + address is omitted to cause the SIM profile configuration to be unsuccessfully performed in the process of attaching to the eSIM server, the terminal adds the ID of the currently attached PLMN to the forbidden PLMN list of the initial configuration and then performs the detach and attach request process in order (1 b-018). If the configuration of the SIM profile is successfully performed, the terminal 1b-100 performs a normal attach procedure using the downloaded SIM profile to use the data service (1 b-019).

Fig. 1ca and 1cb are diagrams illustrating a network connection scheme for a terminal installed with an eSIM to perform initial configuration according to an embodiment of the present disclosure. Hereinafter, fig. 1ca and 1cb are generally referred to as fig. 1 c.

Referring to fig. 1c, in an embodiment of the present disclosure, there is shown: obtaining a connection by connecting to a cellular network, receiving a configuration of a SIM profile through an eSIM server, and performing a process of connecting to the network using the downloaded SIM profile. The technique shown in fig. 1c is similar to the technique shown in fig. 2b, except for the procedure where the GW installs the packet filter in the default EPS bearer.

In the activated state, the terminal 1c-100 checks the SIM profile, and if the SIM profile does not exist, the terminal recognizes the necessity of initial configuration and transfers a list of available PLMNs to an application of the terminal or an entity responsible for initial configuration based on the list of PLMNs sensed through cell search (1 c-001).

The terminal 1c-100 may select a PLMN to connect to for initial configuration (1c-002) based on the transferred PLMN list. The selection of the PLMN may be performed by a selection input of the user or in a priority order according to a specific priority rule in the terminal. For example, in the case of a smartphone that facilitates user input, the initial configuration application presents a list of PLMNs that may be selected through the UI, and the user may select the PLMN through which the user wishes to receive the configuration. As another method, if it is difficult to make user input, for example, if a communication network service provider to be used is determined later after an IoT service provider purchases an IoT directed terminal, and thus there is no information about the communication network service provider in the terminal, a PLMN corresponding to the highest priority, such as a PLMN having the highest signal strength among available PLMNs, may be selected according to a priority rule of the terminal itself.

The terminal 1c-100 requests a network connection through the PLMN selected in the above procedure while transmitting an attach request to the MME 1 c-200. In this case, through the attach request message, it can be known that the attach type is for initial configuration (1 c-003). For example, "attach type ═ initial configuration" may be used. In this case, the attach request message may include an identification of the terminal, e.g., two or one of an international mobile station equipment identification (IMEI) or an eUICC identification (e.g., eUICC ID). Further, the attach request message may include two or one of an address of an SM-DS server and an address of an SM-DP + server to be connected to the terminal.

The MME 1c-200 sends a request message to the EIR 1c-300 in order to determine whether the terminal 1c-100 sending the attach request is a terminal admitted in the corresponding PLMN or not, or whether the eUICC used by the terminal 1c-100 is an admitted eUICC. The request message may include at least one of an IMEI and an eUICC ID, and may request to check whether the ID is granted with respect to each identifier or both identifiers (1 c-004).

The EIR 1c-300 checks whether the terminal or the eUICC is a connection-permitted terminal or a connection-permitted eUICC based on the information received from the MME 1c-200(1 c-005).

The EIR 1c-300 may determine whether the IMEI or eUICC ID is permitted in the following manner: if the sent ID is in a blacklist of IMEI or eUICC IDs managed to prevent managed inferiority or theft in the corresponding service provider network or to prevent online opening, then network connection is denied. As another approach, the network connection is only permitted if the sent ID is included in a white list of IMEI or eUICC IDs of the terminal that can be specifically permitted by the corresponding service provider to open online. In case that the terminal manufacturer, which has manufactured the IoT terminal, provides information on the IMEI or the eUICC ID to the IoT service provider without providing a network open to the IoT service provider, and the IoT service provider later signs up to use the network of the communication network service provider, the information on the IMEI or the eUICC ID received from the terminal manufacturer is transferred to the communication network service provider. The communication network service provider may store a white list in EIR 1c-300 based on the communicated information and may grant attachment only with respect to the terminal to which the IMEI or eUICC ID is to be subscribed, by checking by EIR whether the IMEI, eUICC ID or both are permitted IDs with respect to all terminals that sent an attach request for initial configuration.

The EIR 1c-300 may send information indicating whether the connection of the terminal 1c-100 or the eUICC is permitted or not to the MME 1c-200(1 c-006).

If the information received from the EIR 1c-300 indicates that the connection is not permitted, the MME 1c-200 may send an attach reject message to the terminal 1c-100 to reject the network connection (1 c-007). In this case, the rejection reason included in the rejection message may include that the eUICC ID in the PLMN does not match, the IMEI in the PLMN does not match, the eUICC ID is not available in the PLMN, and the IMEI is not available in the PLMN.

Upon receiving the attach reject message, the terminal 1c-100 may store the ID of the corresponding PLMN in an initially configured forbidden PLMN list, and may reselect a PLMN among available PLMNs (1 c-008). In this case, PLMNs included in the initially configured forbidden PLMN list are excluded from the available PLMN list. The selection of the PLMN is performed in the same way as 1c-002 and the terminal 1c-100 performs the attach request procedure again for initial configuration.

On the other hand, if the EIR 1c-300 notifies the MME 1c-200 that the connection of the terminal 1c-100 has been granted (1c-006), the MME 1c-200 omits the authentication/authorization procedure for security and selects a GW for initial configuration. That is, in the embodiment of the present disclosure, since the attach procedure is an attach procedure for configuration, it is newly proposed for the MME 1c-200 to omit the authentication/authorization procedure. At operation 1c-003, the terminal 1c-100 can append the PDN connectivity request on the attach request message, and even if the PDN connectivity request is not delivered together if the access type of the attach request message is for initial configuration, the MME 1c-200 selects the GW1c-400 for performing the initial configuration and delivers a create session request to the GW1c-400 to request the GW to make the PDN connection (1 c-010). In this case, if the GW for initial configuration is not designated to function as a separate entity in the network, the create session request includes an indication that the initial configuration can be notified. Further, the create session request may include an address of the SM-DS server or an address of the SM-DP + server received from the terminal 1 c-100.

On the other hand, if it is recognized that the create session request is for initial configuration, the GW1c-400 that received the create session request may allocate an IP address, operate to generate a default EPS bearer context, and send a create session response to the MME 1c-200(1 c-011). If a create session response is received, the MME 1c-200 may send an attach accept message to the terminal 1c-100 and at this point the MME 1c-200 may also send an activate default EPS bearer context request together. Details have already been described with reference to fig. 2 b.

After or just after sending the create session response, the GW1c-400 generates a TFT in the default EPS bearer so that the terminal 1c-100 can use it only for the purpose of the initially configured traffic, and the GW1c-400 configures an uplink/downlink packet filter so that communication becomes possible only if the address of the eSIM server (e.g., SM-DP + server or SM-DS server) is included as the target/source IP address (1 c-013).

In configuring the uplink/downlink packet filter, an IP address to be used for specific filtering may be determined based on an address of an SM-DS server or an address of an SM-DP + server received from the terminal 1c-100, or an address served by the terminal 1c-100 may be used for authorization.

GW1c-400 may include a TFT in the update bearer request to be sent to the MME to apply the TFT, which includes the uplink/downlink packet filters for the default EPS bearer, as described above (1 c-014).

On the other hand, the MME 1c-200 receiving the create session response message may send an activate default EPS bearer context request to the terminal 1c-100 together with an attach accept request. The terminal 1c-100 may communicate an attach complete message to the MME 1c-200 and at this point the terminal 1c-100 may communicate together an activate default EPS bearer context accept message (1 c-015). Thereafter, the terminal 1c-100 can establish a PDN connection (1c-016) with the GW1 c-400.

Further, at operation 1c-014, the MME 1c-200 receiving the update bearer request applies the TFT including the packet filter limiting the use of the traffic to only the initial configuration to the default EPS bearer through EPS bearer change, and notifies the GW1c-400 of the result through an update bearer response message. That is, the MME 1c-200 sends a change EPS bearer context request message to the terminal 1c-100(1 c-017). The terminal 1c-100 sends a change EPS bearer context accept message to the MME 1 c-200. Thereafter, the MME 1c-200 sends an update bearer response message to the GW1 c-400.

Thereafter, the terminal can attach to the eSIM server 1c-500 using the obtained connection to receive the configuration of the SIM profile (1 c-020). If the SM-DS address exists in the packet filter configured in the TFT but the SM-DP + address is omitted to cause the SIM profile configuration to be unsuccessfully performed in the process of attaching to the eSIM server 1c-500, the terminal 1c-100 adds the ID of the currently attached PLMN to the initially configured forbidden PLMN list and then performs the detach and attach request process (1c-021) in order. If the configuration of the SIM profile is successfully performed, the terminal 1c-100 may perform a normal attach procedure using the downloaded SIM profile to use the data service (1 c-022).

Fig. 1da to 1dc are diagrams illustrating a network connection scheme for a terminal installed with an eSIM according to an embodiment of the present disclosure to perform initial configuration in consideration of ID security. In the following, fig. 1da to 1dc are generally referred to as fig. 1 d.

Referring to fig. 1d, in an embodiment of the present disclosure, there is shown: obtaining a connection by connecting to a cellular network, receiving a configuration of a SIM profile through an eSIM server, and performing a process of connecting to the network using the downloaded SIM profile. In particular, this embodiment includes a method for encrypting information such as an IMEI or eUICC ID.

In the activated state, the terminal 1d-100 checks the SIM profile, and if the SIM profile does not exist, the terminal recognizes the necessity of initial configuration and transfers a list of available PLMNs to an application of the terminal or an entity responsible for initial configuration based on the list of PLMNs sensed through cell search (1 d-001).

The terminal 1d-100 may select a PLMN to connect to for initial configuration (1d-002) based on the transferred PLMN list. The selection of the PLMN may be performed by a selection input of the user or in a priority order according to a specific priority rule in the terminal. For example, in the case of a smartphone that facilitates user input, the initial configuration application presents a list of PLMNs that may be selected through the UI, and the user may select the PLMN through which the user wishes to receive the configuration. As another method, if it is difficult to make user input, for example, if a communication network service provider to be used is determined later after an IoT service provider purchases an IoT directed terminal, and thus there is no information about the communication network service provider in the terminal, a PLMN corresponding to the highest priority, such as a PLMN having the highest signal strength among available PLMNs, may be selected according to a priority rule of the terminal itself.

The terminal 1d-100 requests a network connection through the PLMN selected in the above procedure, while sending an attach request to the MME functional entity 1 d-200. In this case, through the attach request message, it can be known that the attach type is for initial configuration (1 d-003). For example, "attach type ═ initial configuration" may be used.

The MME functional entity 1d-200 that receives the attach request triggers an Extensible Authentication Protocol (EAP) procedure, and the terminal 1d-100 authenticates the AAA server 1d-600 through EAP-TLS or EAP-TTLS between the terminal 1d-100 and the AAA server 1d-600 in the network based on the AAA server certificate, and generates a secure tunnel (1d-004) based on an encryption key created in the Authentication procedure.

If a secure tunnel is generated, the terminal 1d-100 sends the IMEI, the eUICC ID or both to the MM functional entity 1d-200(1 d-005). Likewise, the MM functional entity 1d-200 determines whether the transmitted ID is a permitted ID by transmitting the IMEI, the eUICC ID, or both to the EIR 1 d-300.

Further, the terminal 1d-100 may transmit to the MM functional entity 1d-200 a message including both or one of an address of an SM-DS server and an address of an SM-DP + server to be connected to the terminal 1 d-100.

As another embodiment, the above-described procedures of operations 1d-005, 1d-006, 1d-007, and 1d-008 may be replaced by a method in which the terminal transfers the IMEI, the eUICC ID, or both IDs to the AAA server through an EAP message at operation 1d-004, and the AAA server determines whether the transferred ID is a permitted ID by transmitting the IMEI, the eUICC ID, or both IDs to the EIR.

The EIR 1d-300 checks whether the terminal or the eUICC is a connection-permitted terminal or a connection-permitted eUICC based on the information received from the MM functional entity 1d-200(1 d-007).

The EIR may determine whether to grant the IMEI or eUICC ID as follows: if the sent ID is in a blacklist of IMEI or eUICC IDs managed to prevent managed inferiority or theft in the corresponding service provider network or to prevent online opening, then network connection is denied. As another approach, the network connection is only permitted if the sent ID is included in a white list of IMEI or eUICC IDs of the terminal, which can be specifically permitted by the corresponding service provider to open online, wherein. In case that the terminal manufacturer, which has manufactured the IoT terminal, provides information on the IMEI or the eUICC ID to the IoT service provider without providing a network open to the IoT service provider, and the IoT service provider later signs up to use the network of the communication network service provider, the information on the IMEI or the eUICC ID received from the terminal manufacturer is transferred to the communication network service provider. The communication network service provider may store a white list in EIR 1d-300 based on the communicated information and may grant attachment only with respect to the terminal to which the IMEI or eUICC ID is to be subscribed, by checking by EIR whether the IMEI, eUICC ID or both are permitted IDs with respect to all terminals that sent an attach request for initial configuration.

The EIR 1d-300 may send information indicating whether the connection of the terminal 1d-100 or eUICC is permitted or not to the MM functional entity 1d-200(1 d-008).

If the information received from the EIR 1d-300 indicates that the connection is not permitted, the MM functional entity 1d-200 may send an attach reject message to the terminal 1d-100 to reject the network connection (1 d-009). In this case, the rejection reason included in the rejection message may include that the eUICC ID in the PLMN does not match, the IMEI in the PLMN does not match, the eUICC ID is not available in the PLMN, and the IMEI is not available in the PLMN.

Upon receiving the attach reject message, the terminal 1d-100 may store the ID of the corresponding PLMN in an initially configured forbidden PLMN list, and may select a PLMN among available PLMNs (1 d-010). In this case, PLMNs included in the initially configured forbidden PLMN list are excluded from the available PLMN list. The selection of the PLMN is performed in the same way as 1d-002 and the terminal 1d-100 performs the attach request procedure again for initial configuration.

On the other hand, if the EIR 1d-300 notifies the MM functional entity 1d-200 of connection permission (1d-008), the MM functional entity 1d-200 omits the authentication/authorization procedure for security (1d-011) and requests the SM functional entity 1d-201 to generate a PDU session for initial configuration (1 d-012). That is, in the embodiment of the present disclosure, since the attach procedure is an attach procedure for configuration, it is newly proposed to omit the authentication/authorization procedure for the MM functional entity 1 d-200. At operation 1d-003, the terminal 1d-100 may append the PDN connection request on the attach request message, and the MM functional entity 1d-200 may request the SM functional entity 1d-201 to generate a PDU session for performing initial configuration even if the PDN connection request is not passed along in case the access type of the attach request message is for initial configuration. In this case, the PDU generation request message may include the address of the SM-DS server or the address of the SM-DP + server received from the terminal 1 d-100.

The SM functional entity 1d-201 that received the PDU generation request selects the GW 1d-400 for initial configuration and passes a create session request to the GW 1d-400 to request the GW to make a PDU connection (1 d-014). In this case, if the GW for initial configuration is not designated to function as a separate entity in the network, the create session request includes an indication that the initial configuration can be notified.

Further, the create session request may include the address of the SM-DS server or the address of the SM-DP + server received from the terminal 1 d-100.

On the other hand, if it is recognized that the create session request is for initial configuration, then the GW 1d-400 that received the create session request may assign an IP address and may operate to generate a default bearer context. In this case, the GW generates a TFT in a default bearer so that the terminal 1d-100 can use it only for the purpose of initially configured traffic, and configures an uplink/downlink packet filter so that communication becomes possible only if an address of an eSIM server (e.g., SM-DP + server or SM-DS server) is included as a target/source IP address (1 d-015).

In configuring the uplink/downlink packet filter, an IP address to be used for specific filtering may be determined based on an address of an SM-DS server or an address of an SM-DP + server received from the terminal 1d-100, or an address served by the terminal 1d-100 may be used for authorization.

If GW 1d-400 has sent a TFT including an uplink/downlink packet filter for a default bearer to SM function 1d-201 as described above (1d-016), SM function 1d-201 can configure a PDU connection through a message for bearer setup between MM function 1d-200 and terminal 1d-100 and in the process, pass the TFT information to terminal (1 d-017).

Further, as another example, instead of passing the TFT generated at operation 1d-015 to terminal 1d-100 through operations 1d-016 and 1d-017, GW 1d-400 may pass the TFT that restricts the use of the traffic to only the initially configured TFT (1d-018, 1d-019, and 1d-020) to terminal 1d-100 by updating the default bearer through the bearer update request.

Thereafter, the terminal can attach to the eSIM server 1d-500 using the obtained connection to receive the configuration of the SIM profile (1 d-021). If the SM-DS address exists in the packet filter configured in the TFT but the SM-DP + address is omitted to cause the SIM profile configuration to be unsuccessfully performed in the process of attaching to the eSIM server 1d-500, the terminal 1d-100 adds the ID of the currently attached PLMN to the initially configured forbidden PLMN list, and then performs the detach and attach request process (1d-022) in order. If the configuration of the SIM profile is successfully performed, the terminal 1d-100 can perform a normal attach procedure using the downloaded SIM profile to use the data service (1 d-023).

< second embodiment >

Fig. 2a is a diagram showing the structure of a network in which a terminal having an eSIM installed therein performs SIM profile configuration. A terminal (or User Equipment (UE)) is installed with an embedded universal integrated circuit (eUICC) in order to use esims. After the terminal secures a connection by connecting to a packet core network, the eUICC receives a configuration of a SIM profile corresponding to a Mobile Network Operator (MNO) that will use data services from an eSIM server (e.g., SM-DP + server) in which the SIM profile is stored. If the terminal or eUICC does not have the address of the SM-DP + server, the terminal receives the configuration of the SIM profile by attaching to the SM-DS server (i.e., the eSIM server for searching for the address of the SM-DP + server in which the SIM profile of the particular terminal is stored) after obtaining the address of the appropriate SM-DP + server.

The Packet core network to which the terminal attaches to ensure connection may be, for example, a cellular network providing data communication, and may be, for example, an Evolved Packet System (EPS) providing an LTE network service or a 5G network. There may be a Control Plane (CP) function in charge of Control-related functions such as mobility management or session management, and a User Plane (UP) function in charge of a UP function such as a packet data gateway for forwarding of User data. The CP function may act as an authenticator for triggering an Extensible Authentication Protocol (EAP) procedure in an EAP Authentication procedure, and may also perform management of a security context for encrypting signaling messages after such Authentication.

In addition, the subscriber data repository may store therein subscription information of the subscriber, for example, an ID (i.e., EID) of the eUICC of the subscribed subscriber terminal and address information of the SM-DP + storing the SIM profile corresponding to the EID. Further, an EID white list (which is a list of information for euiccs that are permitted) may be stored in the user data repository, or an EID black list (which is a list of information for euiccs that are not permitted) may be stored therein. Further, the user data repository is an entity that provides, based on the stored information, address information of SM-DP + in which a SIM profile related to whether the eUICC is an eUICC that is a subscribed terminal or not is stored, or determines whether the eUICC is a permitted eUICC or not. A subscription portal is a subscription portal server to which a user can attach to select a desired subscription plan. In addition, there is an AAA server for authenticating the eUICC. The AAA server has a Certificate of a root Certificate Authority (CA), and the eUICC also has its own Certificate, a private key, and a Certificate of the root Certificate Authority (CA), and if encryption is not performed in the process of connecting to the packet core network, the AAA server is not used. Although not shown in fig. 1b, the system may include a base station, and the terminal and the MM or the terminal and the MME may transmit and receive signals, information, data, and messages through the base station.

Fig. 2ba to 2be are diagrams showing a network connection scheme for a terminal installed with an eSIM to perform remote provisioning (remote provisioning) by determining subscription/non-subscription in an EAP procedure. Hereinafter, fig. 2ba to 2be are generally referred to as fig. 2 b.

Referring to fig. 2b, in an embodiment of the present disclosure, there is shown: a process in which a user or a terminal, which has subscribed to a specific carrier and does not have a SIM profile, obtains a connection by attaching to a cellular network and receives a configuration of the SIM profile through an eSIM server.

Accordingly, at operation 2b-001, the user data repository 2b-500 stores therein ID (i.e., EID) information of the eUICC provided in the terminal 2b-100 subscribed by the user or the terminal 2b-100 subscribed by the IoT service provider, and also stores therein address information of the eSIM server 2b-600 that provides configuration of subscription data corresponding to the EID and a SIM profile corresponding to the EID. For example, the eSIM server 2b-600 that provides the SIM profile configuration may be, for example, SM-DP +. In the description of the present disclosure, SM-DP + is used for convenience to generically refer to SM-DP + authenticated by GSMA and eSIM providing SIM profile configuration.

On the other hand, the specific SM-DP +2b-600 is a configuration server in which a SIM profile corresponding to the EID of the subscribed terminal 2b-100 is stored, and address information of the SM-DP + is mapped on EID information to be stored in the subscriber data repository.

In the start-up state, the terminal 2b-100 checks the SIM profile and if there is no SIM profile, the terminal recognizes that it is necessary to receive the configuration of the SIM profile and obtains a PDU connection in order to receive the configuration. If it is determined or set that the terminal 2b-100 receives a PDU connection through the cellular network, the terminal 2b-100 passes the list of available PLMNs to the application of the terminal or the entity responsible for configuration (2b-002) based on the list of PLMNs sensed through the cell search.

The terminal 2b-100 may select a PLMN to connect to for configuration based on the communicated list of available PLMNs (2 b-003). The selection of the PLMN by the terminal 2b-100 may be performed by a user's selection input or in a priority order according to specific priority rules in the terminal 2 b-100. For example, if the user already knows the subscribed PLMN information, the configuration application presents a list of PLMNs that may be selected through the UI and the user may select the subscribed PLMNs through which the user wishes to receive the configuration. As another method, if subscribed PLMN information has been set in the terminal 2b-100, it is possible to select a subscribed PLMN by which the user wishes to receive the configuration. As yet another method, if the communication network service provider to be used is determined later after the IoT service provider purchases the IoT directed terminal, and thus there is no information about the communication network service provider in the terminal 2b-100, the PLMN corresponding to the highest priority may be selected according to the priority rule of the terminal 2b-100 itself, such as selecting the PLMN having the highest signal strength among the available PLMNs or randomly selecting a PLMN among the available PLMNs.

The terminal 2b-100 requests a network connection through the PLMN selected in the above procedure while transmitting an attach request to the CP function 2b-200(2 b-004). In this case, since a terminal that has subscribed to the carrier should receive the configuration of the SIM profile, the attach type may be separately indicated in the attach request message in order to indicate the attach procedure. For example, the terminal sets "attach type — remote configuration". In this case, the attach request message may include an identification of the terminal 2b-100, e.g. an international mobile station equipment identification (IMEI). Further, when the attach request message is delivered to an Access Stratum (AS), a non-access stratum (NAS) of the terminal may indicate that the access request message is configured for the SIM. Information indicating the SIM configuration may be communicated to the base station and may be used by the base station to select the appropriate CP function.

The CP function 2b-200 or the authenticator 2b-200 having received the attach request triggers an authentication procedure between the eUICC and the network. For example, the CP function 2b-200 or the authenticator 2b-200 triggers the EAP procedure 2b-005, and the eUICC of the terminal authenticates the AAA2b-400 through EAP-TTLS between the eUICC and the network based on the AAA certificate, or performs mutual authentication between the eUICC and the AAA of the terminal 2b-100 based on the eUICC certificate, and creates a secure tunnel between the terminal 2b-100 and the AAA2b-400 based on an encryption key created during the authentication procedure. The terminal 2b-100 sends the eUICC information to AAA2b-400(2b-005a) through the created secure tunnel. The eUICC information may include an eUICC ID (i.e., EID), and may also include an address of a server (e.g., SM-DP +) for configuring a SIM profile preset in the terminal 2b-100 or the eUICC or a server (e.g., SM-DS) for searching an address of the provisioning server.

The AAA, having received the eUICC information, sends an eUICC ID check request message including the eUICC information to the user data repository 2b-500 in order to determine whether the eUICC is an eUICC of a subscribed user or not (2b-005 b).

The user data repository 2b-500 determines whether the received eUICC ID has been subscribed (2b-005 c). If no information about the corresponding eUICC ID exists in the subscriber data repository, it is checked whether the received eUICC ID not yet subscribed to the corresponding PLMN corresponds to a terminal already subscribed to another PLMN. That is, the user data repository may be attached to a server (e.g., SM-DS) capable of searching for the address of the provisioning server, and may discover which PLMN the terminal has subscribed to with respect to the corresponding eUICC ID, or what SIM profile provisioning is provided by the server (e.g., SM-DP +) that has stored the SIM profile for that eUICC ID.

The user data repository 2b-500 passes the information of the relevant server to the AAA2b-400(2b-005 d) along with the subscription/unsubscribe of the eUICC ID.

For example, for an eUICC that has subscribed to a PLMN to which the terminal is attached, address information of a provisioning server (e.g., SM-DP +) storing a SIM profile of the eUICC ID may be included therein. Of course, address information of a server (e.g., SM-DS) capable of searching the configuration server may be included therein. Further, ID information of a PLMN for notifying information of subscribed PLMNs may also be included therein. However, if the eUICC is determined to be an eUICC of a PLMN to which the terminal is attached without subscription, it may be notified that the eUICC is an unsubscribed eUICC, and if the eUICC is determined to have subscribed to an eUICC of another PLMN at operation 2b-005c, ID information of the PLMN for notifying information of the subscribed PLMN may also be included therein. In addition, address information of a provisioning server (e.g., SM-DP +) storing a SIM profile of the eUICC ID may also be included therein. Of course, address information of a server (e.g., SM-DS) capable of searching the configuration server may also be included therein.

On the other hand, the AAA2b-400, having received the information on whether or not the eUICC has been subscribed to, may pass the information to the CP function 2b-200 or the authenticator 2b-200(2b-005e) together with the authentication result in the process of completing the authentication procedure. For example, if EAP authentication has been successfully completed, the AAA may pass along with a Master Session Key (MSK; Master Session Key) created during authentication address information for a provisioning server (e.g., SM-DP +) that stores the SIM profile for the eUICC ID. Of course, address information of a server (e.g., SM-DS) capable of searching the configuration server may also be included therein. Further, the eUICC has subscribed to which PLMN can be included in the ID of the PLMN. If the ID of the PLMN is omitted, then it can be known that the eUICC has subscribed to the PLMN being attached. However, if the EAP authentication fails or if the eUICC is an unsubscribed eUICC, the EAP failure may be sent to the CP function 2b-200 or the authenticator 2 b-200. Even in this case, if it is grasped the PLMN to which the corresponding terminal 2b-100 has subscribed, the ID of the subscribed PLMN may be included in the EAP failure message.

After the authentication procedure is complete, if the eUICC has not subscribed to the corresponding PLMN and therefore does not permit attachment to the network, or if the EAP fails and therefore does not permit attachment (2b-007), the CP function 2b-200 or authenticator 2b-200 performs an attach reject. In this case, when the attach reject message is sent to the terminal 2b-100, the terminal is notified that the eUICC has not subscribed to the corresponding PLMN as a reject reason. For example, a "cause-invalid eUICC" or "eUICC has not subscribed to the PLMN" may be set. Further, if the CP function or authenticator 2b-200 knows that the eUICC has subscribed to another PLMN, the ID information of the subscribed PLMN may be included therein (2 b-007).

Upon receiving the attach reject message, the terminal 2b-100 may store the ID of the corresponding PLMN in a SIM-configured forbidden PLMN list and may apply a back-off timer for a predetermined time. If the attach reject message includes the ID of the PLMN to which the eUICC has subscribed, the received PLMN may be selected to perform the next attach (2 b-008). When the terminal 2b-100 selects a PLMN among available PLMNs to perform next attachment, PLMNs included in the forbidden PLMN list for SIM configuration are excluded from the available PLMN list. In this case, the selection of the PLMN is performed in the same way as 2b-003, and the terminal 2b-100 performs the attach request procedure again for remote configuration.

On the other hand, the terminal 2b-100 and the CP function 2b-200 or the authenticator 2b-200 share a security context based on the MSK obtained at operation 2b-005e, and perform synchronization (2b-009) on a security key to be used in a non-access stratum (NAS) and an Access Stratum (AS). Operation 2b-009 may be performed before sending the attach reject.

If the setting of the security key is completed, the CP function or authenticator 2b-200 may send an attach Accept message to the terminal 2b-100 to inform of the successful attach to the network (2 b-010). The attach accept message may include address information of a provisioning server (e.g., SM-DP +) that stores the SIM profile of the eUICC ID.

The terminal 2b-100 requests the CP function 2b-200 to create a PDU connection for SIM configuration (2 b-011). The PDU connection request message may configure a separate type to inform that the PDU connection is for performing SIM configuration. For example, "type ═ SIM configuration" may be set. On the other hand, at operation 2b-004, the terminal 2b-100 may attach a PDU connection request message to the attach request message, and may continue the session creation procedure to make a PDU connection for SIM configuration even if the PDU connection request message is not delivered together in the case where the access type of the attach request message is for remote configuration.

The CP function 2b-200 having received the PDU connection creation request selects an appropriate UP function in order to transmit a create session request message. In this case, the CP function may select the UP function in consideration of the SIM configuration, or may select an appropriate network slice and select an appropriate UP function of the selected network slice.

The CP function 2b-200 sends a create session request message to the appropriate UP function 2b-300(2 b-012). The create session request message may include the address of the SM-DS server or the address of the SM-DP + server received at operations 2b-005 e. Further, the create session request message may include an address of the SM-DS server or an address of the SM-DP + server received from the terminal 2 b-100. The create session request message may include an indication that the request for SIM configuration can be notified.

Subsequently, the UP function 2b-300 selects a GW for SIM configuration and configures an IP address thereto. In this case, the PDU connection may be configured such that the terminal 2b-100 may attach only to the address of the SM-DP + server for configuration, the address of the SM-DS server for searching SM-DP +, the address of the DNS server, and the address of the subscription portal, so that the terminal 2b-100 may use it only for the purpose of the SIM-configured service (2 b-013). For example, the uplink/downlink packet filter of the packet filter may be configured such that communication becomes possible only if a specifically configured address (e.g., an address of an SM-DP + server for configuration, an address of an SM-DS server for searching SM-DP +, an address of a DNS server, or an address of a subscription portal) is included as a target/source IP address.

In configuring the uplink/downlink packet filter, an IP address to be used for specific filtering may be determined based on an address of an SM-DS server or an address of an SM-DP + server received from the terminal 2b-100 or an address of an SM-DS server or an address of an SM-DP + server delivered through the operations 2b-005e and 2b-012, or an address served by the terminal 2b-100 may be used for authorization. Furthermore, in case of attempting to attach to another address than the above-mentioned one, a redirection rule may be set in the UP function 2b-300 in order to redirect the attachment to the subscription portal.

The UP function 2b-300 may pass the response to the CP function 2b-200(2b-014) and the CP function 2b-200 may pass the PDU connect response message to the terminal 2b-100(2 b-015). In this case, the address of the SM-DP + server for configuration may be delivered to the terminal 2b-100 together with the PDU connect response message.

Thereafter, the terminal 2b-100 attaches to the SM-DP +2b-600 using the obtained PDU connection to receive the SIM profile (2 b-017). However, if the terminal 2b-100 tries to attach to an address other than the granted address so that the terminal 2b-100 can use this address only for the purpose of SIM-configured services, the attachment is redirected to the subscription portal (2 b-016).

On the other hand, if the SIM configuration is delayed for a predetermined time or the SIM configuration fails, the terminal adds the ID of the currently attached PLMN to the forbidden PLMN list of the initial configuration and then performs the detach and attach request procedure in order (2 b-018).

If the configuration of the SIM profile is successfully performed, the terminal 2b-100 may perform a detach process for the attachment using the downloaded SIM profile (2 b-019). After selecting the downloaded SIM profile, the terminal 2b-100 may perform an attach procedure to use the data service (2 b-020).

Instead of performing the operations 2b-019 and 2b-020, the terminal 2b-100 may not perform the detach process, but may select a downloaded SIM profile and then may update existing attachment information to use a normal data service.

Fig. 2ca to 2cd are diagrams illustrating a network connection scheme for a terminal installed with an eSIM to perform initial configuration through an EAP procedure and a separate subscription/unsubscribe determination procedure. Hereinafter, fig. 2ca to 2cd are generally referred to as fig. 2 c.

Referring to fig. 2c, in an embodiment of the present disclosure, there is shown: a process in which a user or a terminal, which has subscribed to a specific carrier and does not have a SIM profile, obtains a connection by attaching to a cellular network and receives a configuration of the SIM profile through an eSIM server.

Thus, at operation 2c-001, the user data repository 2c-500 stores therein ID (i.e., EID) information of the eUICC provided in the terminal 2c-100 subscribed by the user or the terminal 2c-100 subscribed by the IoT service provider, and also stores therein address information of the eSIM server 2c-600 that provides configuration of subscription data corresponding to the EID and a SIM profile corresponding to the EID. For example, the eSIM server 2c-600 that provides the SIM profile configuration may be, for example, SM-DP +. In the description of the present disclosure, SM-DP + is used for convenience to generically refer to SM-DP + authenticated by GSMA and eSIM providing SIM profile configuration.

On the other hand, the specific SM-DP +2c-600 is a configuration server in which a SIM profile corresponding to the EID of the subscribed terminal 2c-100 is stored, and address information of the SM-DP + is mapped on EID information to be stored in the subscriber data repository.

In the start-up state, the terminal 2c-100 checks the SIM profile and if there is no SIM profile, the terminal recognizes that it is necessary to receive the configuration of the SIM profile and obtains a PDU connection in order to receive the configuration. If it is determined or set that the terminal 2c-100 receives a PDU connection through the cellular network, the terminal 2c-100 passes the list of available PLMNs to the application of the terminal or the entity responsible for configuration (2c-002) based on the list of PLMNs sensed through the cell search.

The terminal 2c-100 may select a PLMN to connect to for configuration based on the communicated list of available PLMNs (2 c-003). The selection of the PLMN by the terminal 2c-100 may be performed by a user's selection input or in a priority order according to specific priority rules in the terminal 2 c-100. For example, if the user already knows the subscribed PLMN information, the configuration application presents a list of PLMNs that may be selected through the UI and the user may select the subscribed PLMNs through which the user wishes to receive the configuration. As another method, if subscribed PLMN information has been set in the terminal 2c-100, it is possible to select a subscribed PLMN by which the user wishes to receive the configuration. As yet another method, if the communication network service provider to be used is determined later after the IoT service provider purchases the IoT directed terminal, and thus there is no information about the communication network service provider in the terminal 2c-100, the PLMN corresponding to the highest priority may be selected according to the priority rule of the terminal itself, such as selecting the PLMN having the highest signal strength among the available PLMNs or randomly selecting the PLMN among the available PLMNs.

The terminal 2c-100 requests a network connection through the PLMN selected in the above procedure, and simultaneously sends an attach request to the CP function 2c-200(2 b-004). In this case, since a terminal that has subscribed to the carrier should receive the configuration of the SIM profile, the attach type may be separately indicated in the attach request message in order to indicate the attach procedure. For example, the terminal sets "attach type — remote configuration". In this case, the attach request message may include an identification of the terminal 2c-100, e.g. an international mobile station equipment identification (IMEI). Further, when the attach request message is delivered to the Access Stratum (AS), a non-access stratum (NAS) of the terminal 2c-100 may indicate that the access request message is configured for a SIM. Information indicating the SIM configuration may be communicated to the base station and may be used by the base station to select the appropriate CP function.

The CP function 2c-200 or the authenticator 2c-200 having received the attach request triggers an authentication procedure between the eUICC and the network. For example, the CP function 2c-200 or the authenticator 2c-200 triggers the EAP procedure 2c-005 and performs mutual authentication between the eUICC of the terminal 2c-100 and the AAA 2c-400 through EAP-TLS or EAP-TTLS based on the AAA certificate and the eUICC certificate. In the course of completing the authentication process, the AAA 2c-400 may pass the result of the authentication to the CP function 2c-200 or the authenticator 2c-200(2c-005 a). For example, if the EAP authentication has been successfully completed, a Master Session Key (MSK) created during the authentication process may be passed along with the EAP being successfully sent to the CP function 2c-200 or authenticator 2 c-200. However, if the EAP authentication fails, the EAP failure may be sent to the CP function 2c-200 or the authenticator 2 c-200. In this case, the CP function 2c-200 or authenticator 2c-200 may perform attach rejection (2c-005 b). On the other hand, the terminal 2c-100 and the CP function 2c-200 or the authenticator 2c-200 may share a security context based on the MSK obtained at the operation 2c-005a and may perform synchronization (2c-006) on a security key to be used in a non-access stratum (NAS) and an Access Stratum (AS).

If security is set as described above, a process of checking whether the eUICC has been subscribed may be performed. To this end, the CP function 2c-200 may request eUICC information (2c-007a) from the terminal 2 c-100. If the eUICC information request message (2c-007a) is received or the setting of the security key is completed (2c-006), the terminal 2c-100 may encrypt the eUICC ID of the terminal 2c-100 and transmit it to the CP function 2c-200(2c-007 a).

The eUICC information may include an eUICC ID (i.e., EID), and may include an address of a server (e.g., SM-DP +) for configuring a SIM profile preset in the terminal 2c-100 or the eUICC or an address of a server (e.g., SM-DS) for searching an address of a provisioning server.

The CP function 2c-200 having received the eUICC information sends an eUICC ID check request message including the eUICC information to the user data repository 2c-500 in order to determine whether the eUICC is an eUICC of a subscribed user or not (2c-007 c).

The user data repository 2c-500 determines whether the received eUICC ID has been subscribed (2c-007 d). If no information about the corresponding eUICC ID exists in the subscriber data repository 2c-500, it is checked whether the received eUICC ID not yet subscribed to the corresponding PLMN corresponds to a terminal already subscribed to another PLMN. That is, the user data repository may be attached to a server (e.g., SM-DS) capable of searching for the address of the provisioning server, and may discover which PLMN the terminal has subscribed to with respect to the corresponding eUICC ID, or what SIM profile provisioning is provided by the server (e.g., SM-DP +) that has stored the SIM profile for that eUICC ID.

The user data repository 2c-500 passes the information of the relevant server to the CP function 2c-200(2c-007e) along with the subscription/unsubscribe of the eUICC ID.

For example, for an eUICC that has subscribed to a PLMN to which the terminal is attached, address information of a provisioning server (e.g., SM-DP +) storing a SIM profile of the eUICC ID may be included therein. Of course, address information of a server (e.g., SM-DS) capable of searching the configuration server may be included therein. Further, ID information of a PLMN for notifying information of subscribed PLMNs may also be included therein. However, if the eUICC is determined to be an eUICC of a PLMN to which the terminal is attached without subscription, it may be notified that the eUICC is an unsubscribed eUICC, and if the eUICC is determined to have subscribed to an eUICC of another PLMN at operation 2c-007d, ID information of the PLMN for notifying information of the subscribed PLMN may also be included therein. In addition, address information of a provisioning server (e.g., SM-DP +) storing a SIM profile of the eUICC ID may also be included therein. Of course, address information of a server (e.g., SM-DS) capable of searching the configuration server may also be included therein. Further, an ID for notifying the eUICC of which PLMN the PLMN has subscribed to may be included therein. If the ID of the PLMN is omitted, then it can be known that the eUICC has subscribed to the PLMN to which the terminal 2c-100 is attaching. However, if the eUICC has not subscribed to the corresponding PLMN and thus does not grant an attachment to the network (2c-007f), an attach rejection is performed. In this case, the CP function 2c-200 sends an attach reject message to the terminal 2c-100 and informs the terminal 2c-100 that the eUICC has not subscribed to the corresponding PLMN as a reject reason. For example, a "cause-invalid eUICC" or "eUICC has not subscribed to the PLMN" may be set. Furthermore, if the CP function 2c-200 knows that the eUICC has subscribed to another PLMN, the ID information of the subscribed PLMN may be included therein (2 c-008).

Upon receiving the attach reject message, the terminal 2c-100 may store the ID of the corresponding PLMN in a SIM-configured forbidden PLMN list and may apply a back-off timer for a predetermined time. If the attach reject message includes the ID of the PLMN to which the eUICC has subscribed, the received PLMN may be selected to perform the next attach (2 c-008). When the terminal 2c-100 selects a PLMN among the available PLMNs to perform the next attachment, PLMNs included in the forbidden PLMN list for SIM configuration are excluded from the available PLMN list. In this case, the selection of the PLMN is performed in the same way as 2c-003, and the terminal 2c-100 performs the attach request procedure again for remote configuration.

If the setting of the security key is completed, the CP function 2c-200 or the authenticator 2c-200 may send an attach accept message to the terminal 2c-100 to inform of the successful attach to the network (2 c-010). The attach accept message may include address information of a provisioning server (e.g., SM-DP +) that stores the SIM profile of the eUICC ID.

The terminal 2c-100 requests the CP function 2c-200 to create a PDU connection for SIM configuration (2 c-011). The PDU connection request message may configure a separate type to inform that the PDU connection is for performing SIM configuration. For example, "type ═ SIM configuration" may be set. On the other hand, at operation 2c-004, the terminal 2c-100 may attach a PDU connection request message to the attach request message, and may continue the session creation procedure to make a PDU connection for SIM configuration even if the PDU connection request message is not delivered together in the case where the access type of the attach request message is for remote configuration.

The CP function 2c-200 having received the PDU connection creation request selects an appropriate UP function in order to transmit a create session request message. In this case, the CP function may select the UP function in consideration of the SIM configuration, or may select an appropriate network slice and select an appropriate UP function of the selected network slice.

The CP function 2c-200 sends a create session request message to the appropriate UP function 2c-300(2 c-012). The create session request message may include the address of the SM-DS server or the address of the SM-DP + server received at operations 2c-005 e. Further, the create session request message may include an address of the SM-DS server or an address of the SM-DP + server received from the terminal 2 c-100. The create session request message may also include an indication that the request for SIM configuration can be notified. The UP function 2c-300 then selects the GW for SIM configuration and configures it with an IP address. In this case, the PDU connection may be configured such that the terminal 2c-100 may attach only to the address of the SM-DP + server for configuration, the address of the SM-DS server for searching SM-DP +, the address of the DNS server, and the address of the subscription portal, so that the terminal 2c-100 may use it only for the purpose of SIM-configured traffic (2 c-013). For example, the uplink/downlink packet filter of the packet filter may be configured such that communication becomes possible only if a specifically configured address (e.g., an address of an SM-DP + server for configuration, an address of an SM-DS server for searching SM-DP +, an address of a DNS server, or an address of a subscription portal) is included as a target/source IP address.

In configuring the uplink/downlink packet filter, an IP address to be used for a specific filtering may be determined based on an address of an SM-DS server or an address of an SM-DP + server received from the terminal 2c-100 or an address of an SM-DS server or an address of an SM-DP + server delivered through the operations 2c-005e and 2c-012, or an address served by the terminal may be used for authorization. Furthermore, in case of attempting to attach to another address than the above-mentioned one, a redirection rule may be set in the UP function 2c-300 in order to redirect the attachment to the subscription portal.

The UP function 2c-300 may pass the response to the CP function 2c-200(2c-014) and the CP function 2c-200 may pass the PDU connect response message to the terminal 2c-100(2 c-015). In this case, the address of the SM-DP + server for configuration may be delivered to the terminal 2c-100 together with the PDU connect response message.

Thereafter, the terminal 2c-100 attaches to the SM-DP +2c-600 using the obtained PDU connection to receive the SIM profile (2 c-017). However, if the terminal 2c-100 tries to attach to an address other than the granted address so that the terminal 2c-100 can use this address only for the purpose of SIM-configured services, the attachment is redirected to the subscription portal (2 c-016).

On the other hand, if the SIM configuration is delayed for a predetermined time or the SIM configuration fails, the terminal 2c-100 adds the ID of the currently attached PLMN to the forbidden PLMN list of the initial configuration, and then performs the detach and attach request procedure in order (2 c-018). If the configuration of the SIM profile is successfully performed, the terminal 2c-100 may perform a detach procedure for attachment using the downloaded SIM profile (2 c-019). After selecting the downloaded SIM profile, the terminal may perform an attach procedure to use the data service (2 c-020).

Instead of performing the operations 2c-019 and 2c-020, the terminal 2c-100 may not perform the detach process, but may select a downloaded SIM profile and then may update existing attachment information to use a normal data service.

Fig. 2da to 2dd are diagrams illustrating a network connection scheme for a terminal installed with an eSIM to subscribe and perform provisioning by determining whether to permit an eUICC in an EAP procedure. Fig. 2da to 2dd are generally referred to as fig. 2d hereinafter.

Referring to fig. 2d, in an embodiment of the present disclosure, there is shown: a process in which a terminal that has not subscribed to any carrier obtains a connection by attaching to a cellular network, subscribes to the network online, and receives a configuration of a SIM profile through an eSIM server.

Accordingly, at operation 2d-001, the user data repository 2d-500 has stored therein white list information for IDs (i.e., EIDs) of valid or permitted eUICCs owned by each service provider or blacklist information for IDs of invalid eUICCs reported to be problematic. For example, if a corresponding EID in a particular carrier is subject to an accident such as illegal use or theft, the corresponding EID may be classified into a blacklist as an unapproved EID, and blacklist information may be shared with other carriers according to a relationship between carriers. Further, in the case of terminals manufactured for a specific carrier, EID information of the respective terminals is managed in a white list and can be used to determine whether to permit their attachment for configuration.

On the other hand, a terminal that has not subscribed may select a subscription plan provided by the corresponding service provider by attaching to the subscription portal 2 d-600. In this case, the selected information is interlocked with a commercial sales system (BSS), and an eSIM server providing a configuration of a SIM profile corresponding to an EID of the terminal prepares a SIM profile of a corresponding selected subscription plan.

For example, the eSIM server that provides the SIM profile configuration may be, for example, SM-DP +. In the description of the present disclosure, SM-DP + is used for convenience to generically refer to SM-DP + authenticated by GSMA and eSIM providing SIM profile configuration. In the description of the present disclosure, a detailed interlocking scheme between the subscription portal, BSS and SM-DP + is not described.

In the start-up state, the terminal 2d-100 checks the SIM profile and if there is no SIM profile, the terminal recognizes that it is necessary to receive the configuration of the SIM profile and obtains a PDU connection in order to receive the configuration. If it is determined or set that the terminal 2d-100 receives a PDU connection through the cellular network, the terminal 2d-100 passes the list of available PLMNs to the application of the terminal or the entity responsible for configuration (2d-002) based on the list of PLMNs sensed through the cell search. The terminal may select a PLMN to connect to for configuration based on the communicated list of available PLMNs (2 d-003).

The selection of the PLMN by the terminal 2d-100 may be performed by a user's selection input or in a priority order according to specific priority rules in the terminal 2 d-100. For example, if the user wishes to subscribe to a PLMN, the configuration application presents a list of PLMNs that may be selected through the UI, and the user may select the subscribed PLMNs through which the user wishes to receive the configuration. As another method, if subscribed PLMN information has been set in the terminal 2d-100, it is possible to select a subscribed PLMN by which the user wishes to receive the configuration. As a further method, if the user has no separate preference for the PLMNs to which the user wishes to subscribe, the PLMN corresponding to the highest priority may be selected according to the priority rules of the terminal 2d-100 itself, such as selecting the PLMN with the highest signal strength among the available PLMNs or randomly selecting a PLMN among the available PLMNs.

The terminal 2d-100 requests a network connection through the PLMN selected in the above procedure, and simultaneously transmits an attach request to the CP function 2d-200(2 d-004). In this case, in order to instruct the terminal 2d-100 to subscribe to the carrier and attach to it to receive the configuration of the SIM profile, the terminal individually indicates the type of attachment. For example, "attach type ═ subscription" is set. In this case, the attach request message may include an identification of the terminal 2d-100, e.g. an international mobile station equipment identification (IMEI). Further, when the attach request message is delivered to the Access Stratum (AS), the non-access stratum (NAS) of the terminal 2d-100 may indicate that the access request message is configured for the SIM. Information indicating the SIM configuration may be communicated to the base station and may be used by the base station to select the appropriate CP function.

The CP function 2d-200 or the authenticator 2d-200 having received the attach request triggers an authentication procedure between the eUICC and the network. For example, the CP function 2d-200 or the authenticator 2d-200 triggers the EAP procedure 2d-005, and the eUICC of the terminal authenticates the AAA2d-400 through EAP-TTLS between the eUICC and the AAA2d-400 of the network based on the AAA certificate, or performs mutual authentication between the eUICC of the terminal 2d-100 and the AAA2d-400 based on the AAA certificate and the eUICC certificate, and creates a secure tunnel between the terminal 2d-100 and the AAA2d-400 based on an encryption key created during the authentication procedure. The terminal 2d-100 sends the eUICC information to the AAA2d-400 (2d-005a) through the created secure tunnel. The eUICC information may include an eUICC ID (i.e., EID), and may further include an address of a server (e.g., SM-DP +) for configuring a SIM profile preset in the terminal 2d-100 or the eUICC or a server (e.g., SM-DS) for searching an address of the provisioning server.

The AAA2d-400 that has received the eUICC information may send an eUICC ID report message including the eUICC information to the user data repository 2d-500 in order to determine whether the eUICC is a permitted eUICC (2d-005 b). The user data repository 2d-500 determines whether the received eUICC ID is a permitted eUICC (2d-005 c). The user data repository 2d-500 passes the information of the server for the relevant configuration to the AAA2d-400 (2d-005d) along with the grant/disallowance of the eUICC ID.

For example, for a licensed eUICC, address information of a provisioning server (e.g., SM-DP +) storing a SIM profile of the eUICC ID in the PLMN to which the terminal 2d-100 is being attached may be included therein. Of course, address information of a server (e.g., SM-DS) capable of searching the configuration server may also be included therein.

On the other hand, the AAA2d-400, having received the information on whether to grant the eUICC, may pass the information to the CP function 2d-200 or the authenticator 2d-200(2d-005e) together with the authentication result in the process of completing the authentication procedure. For example, if EAP authentication has been successfully completed, the AAA may pass along with a Master Session Key (MSK) created during authentication address information for a provisioning server (e.g., SM-DP +) that stores the SIM profile for the eUICC ID. Of course, address information of a server (e.g., SM-DS) capable of searching the configuration server may also be included therein. However, if the EAP authentication fails or if the eUICC is a non-permitted eUICC, the EAP failure may be sent to the CP function or authenticator 2 d-200.

After the authentication procedure is complete, if the eUICC is not permitted and therefore not permitted to attach to the network, or if the EAP fails and therefore not permitted to attach (2d-007), the CP function 2d-200 or the authenticator 2d-200 performs an attach reject. In this case, when the attach reject message is sent to the terminal 2d-100, the terminal is notified that the eUICC is not permitted as a reject reason. For example, a "cause-invalid eUICC" or "eUICC is not available in this PLMN" may be set (2 d-007).

Upon receiving the attach reject message, the terminal 2d-100 may store the ID of the corresponding PLMN in a SIM-configured forbidden PLMN list and may apply a back-off timer for a predetermined time. When the terminal 2d-100 selects a PLMN among available PLMNs to perform next attachment, PLMNs included in the forbidden PLMN list for SIM configuration are excluded from the available PLMN list. In this case, the selection of the PLMN is performed in the same method as 2d-003, and the terminal 2d-100 performs the attach request procedure again to subscribe.

On the other hand, the terminal 2d-100 and the CP function 2d-200 or the authenticator 2d-200 share a security context based on the MSK obtained at the operation 2d-005e, and perform synchronization (2d-009) on a security key to be used in a non-access stratum (NAS) and an Access Stratum (AS). Operation 2d-009 may be performed before sending the attach reject.

If the setting of the security key is completed, the CP function 2d-200 or the authenticator 2d-200 may send an attach accept message to the terminal 2d-100 to inform of the successful attach to the network (2 d-010). The attach accept message may include address information of a subscription portal to which the terminal 2d-100 should attach in order to subscribe to the subscription.

The terminal 2d-100 requests the CP function 2d-200 to create a PDU connection for SIM configuration (2 d-011). The PDU connection request message may configure a separate type to inform that the PDU connection is for performing SIM configuration. For example, "type ═ SIM configuration" may be set. On the other hand, at operation 2d-004, the terminal 2d-100 may append the PDU connection request message to the attach request message, and may continue the session creation procedure to make a PDU connection for SIM configuration even if the PDU connection request message is not delivered together if the access type of the attach request message is for subscription.

The CP function 2d-200 having received the PDU connection creation request selects an appropriate UP function in order to transmit a create session request message. In this case, the CP function may select the UP function in consideration of the SIM configuration, or may select an appropriate UP function of an appropriate network slice selected.

The CP function 2d-200 sends a create session request message to the appropriate UP function 2d-300(2 d-012). The create session request message may include the address of the SM-DS server or the address of the SM-DP + server received at operations 2d-005 e. In addition, the create session request message may include an address of the SM-DS server or an address of the SM-DP + server received from the terminal 2 d-100. The create session request message may include an indication that the request for SIM configuration can be notified. The UP function then selects a GW for SIM configuration and configures an IP address thereto. In this case, the PDU connection may be configured such that the terminal 2d-100 may attach only to the address of the SM-DP + server for configuration, the address of the SM-DS server for searching SM-DP +, the address of the DNS server, and the address of the subscription portal, so that the terminal 2d-100 may use it only for the purpose of the SIM-configured service (2 d-013). For example, the uplink/downlink packet filter of the packet filter may be configured such that communication becomes possible only if a specifically configured address (e.g., an address of an SM-DP + server for configuration, an address of an SM-DS server for searching SM-DP +, an address of a DNS server, or an address of a subscription portal) is included as a target/source IP address.

In configuring the uplink/downlink packet filter, an IP address to be used for specific filtering may be determined based on an address of an SM-DS server or an address of an SM-DP + server received from the terminal 2d-100 or an address of an SM-DS server or an address of an SM-DP + server delivered through the operations 2d-005e and 2d-012, or an address served by the terminal 2d-100 may be used for authorization. Furthermore, in case of attempting to attach to another address other than the above-mentioned address, a redirection rule may be set in the UP function in order to redirect the attachment to the subscription portal.

The UP function 2d-300 may pass the response to the CP function 2d-200 and may pass a PDU connect response message to the terminal 2 d-100. In this case, address information of a subscription portal to which the terminal 2d-100 should attach for subscription may be delivered to the terminal.

Thereafter, as in operation 2d-017, the terminal 2d-100 attaches to the subscription portal using the obtained PDU connection and selects and subscribes to the desired subscription plan. In this case, the terminal 2d-100 may deliver the EID information to a subscription portal, or may deliver the EID information via encrypted transmission for secure delivery.

Further, if it is ready for configuration, the SM-DP + may inform the terminal 2d-100 that it is ready for configuration.

Further, the terminal can receive the configuration of the SIM profile by attaching to the corresponding SM-DP + (2 d-018).

However, if the terminal 2d-100 attempts to attach to an address other than the granted address so that the terminal can use this address only for SIM-configured service purposes, the attachment may be redirected to the subscription portal (2 d-016).

On the other hand, if the SIM configuration is delayed for a predetermined time or the SIM configuration fails, the terminal 2d-100 adds the ID of the currently attached PLMN to the forbidden PLMN list of the initial configuration and then performs the detach and attach request procedure in order (2 d-019). If the configuration of the SIM profile is successfully performed, the terminal 2d-100 may select the downloaded SIM profile and may then perform an attach procedure to use the data service (2 d-021). Instead of performing the operations 2d-020 and 2d-021, the terminal 2d-100 may not perform the detach procedure, but may select the downloaded SIM profile and may then update the existing attachment information to use the normal data service.

Fig. 2ea to 2ed are diagrams illustrating a detailed network connection scheme for a terminal installed with an eSIM to subscribe and perform provisioning by determining whether to permit the eUICC in an EAP procedure. Hereinafter, fig. 2ea to 2ed are generally referred to as fig. 2 e.

Referring to fig. 2e, in an embodiment of the present disclosure, there is shown: a process in which a terminal that has not subscribed to any carrier obtains a connection by attaching to a cellular network, subscribes to the network online, and receives a configuration of a SIM profile through an eSIM server.

Accordingly, at operation 2e-001, the user data repository 2e-500 has stored therein white list information for IDs (i.e., EIDs) of valid or permitted eUICCs owned by each service provider or blacklist information for IDs of invalid eUICCs reported to be problematic. For example, if a corresponding EID in a particular carrier is subject to an accident such as illegal use or theft, the corresponding EID may be classified into a blacklist as an unapproved EID, and blacklist information may be shared with other carriers according to a relationship between carriers. Further, in the case of terminals manufactured for a specific carrier, EID information of the respective terminals is managed in a white list and can be used to determine whether to permit their attachment for configuration.

On the other hand, a terminal that has not subscribed may select a subscription plan provided by the corresponding service provider by attaching to the subscription portal 2 e-600. In this case, the selected information is interlocked with a commercial sales system (BSS), and thus, the eSIM server 2e-600 providing the configuration of the SIM profile corresponding to the EID of the terminal prepares the SIM profile of the corresponding selected subscription plan.

For example, the eSIM server that provides the SIM profile configuration may be, for example, SM-DP +. In the description of the present disclosure, SM-DP + is used for convenience to generically refer to SM-DP + authenticated by GSMA and eSIM providing SIM profile configuration.

In the start-up state, the terminal 2e-100 checks the SIM profile and if there is no SIM profile, the terminal recognizes that it is necessary to receive the configuration of the SIM profile and obtains a PDU connection in order to receive the configuration. If it is determined or set that the terminal 2e-100 receives a PDU connection through the cellular network, the terminal 2e-100 transfers a list of available PLMNs to an application of the terminal or an entity responsible for configuration (2e-002) based on the list of PLMNs sensed through the cell search. The terminal may select a PLMN to connect to for configuration based on the communicated list of available PLMNs (2 e-003).

The selection of the PLMN by the terminal 2e-100 may be performed by a user's selection input or in a priority order according to specific priority rules in the terminal 2 e-100. For example, if the user wishes to subscribe to a PLMN, the configuration application presents a list of PLMNs that may be selected through the UI, and the user may select the subscribed PLMNs through which the user wishes to receive the configuration. As another method, if subscribed PLMN information has been set in the terminal 2e-100, it is possible to select a subscribed PLMN by which the user wishes to receive the configuration. As a further method, if the user has no separate preference for the PLMNs to which the user wishes to subscribe, the PLMN corresponding to the highest priority may be selected according to the priority rules of the terminal 2e-100 itself, such as selecting the PLMN with the highest signal strength among the available PLMNs or randomly selecting a PLMN among the available PLMNs.

The terminal requests a network connection through the PLMN selected in the above procedure, and simultaneously transmits an attach request to the CP function 2e-200(2 e-004). In this case, in order to instruct the terminal 2e-100 to subscribe to the carrier and attach to it to receive the configuration of the SIM profile, the terminal individually indicates the type of attachment. For example, "attach type ═ subscription" is set. In this case, the attach request message may include an identification of the terminal 2e-100, e.g. an international mobile station equipment identification (IMEI). Further, when the attach request message is delivered to the Access Stratum (AS), a non-access stratum (NAS) of the terminal 2e-100 may indicate that the access request message is configured for a SIM. Information indicating the SIM configuration may be communicated to the base station and may be used by the base station to select the appropriate CP function.

The CP function 2e-200 or the authenticator 2e-200 having received the attach request triggers an authentication procedure between the eUICC and the network. For example, the CP function 2e-200 or the authenticator 2e-200 triggers the EAP procedure 2e-005, and the eUICC of the terminal authenticates the AAA2e-400 through EAP-TTLS between the eUICC and the AAA2e-400 of the network based on the AAA certificate, or performs mutual authentication between the eUICC of the terminal 2e-100 and the AAA2e-400 based on the AAA certificate and the eUICC certificate, and creates a secure tunnel between the terminal 2e-100 and the AAA2e-400 based on an encryption key created during the authentication procedure. The terminal 2e-100 sends the eUICC information to the AAA2e-400(2e-005 a) through the created secure tunnel. The eUICC information may include an eUICC ID (i.e., EID), and may also include an address of a server (e.g., SM-DP +) for configuring a SIM profile preset in the terminal 2e-100 or the eUICC or a server (e.g., SM-DS) for searching an address of the provisioning server.

The AAA2e-400, having received the eUICC information, may send an eUICC ID report message including the eUICC information to the user data repository 2e-500 in order to determine whether the eUICC is a permitted eUICC (2e-005 b). The user data repository 2e-500 determines whether the received eUICC ID is a permitted eUICC (2e-005 c). The user data repository 2e-500 passes the information for the server of the relevant configuration to AAA2e-400(2e-005d) along with the grant/disallowance of the eUICC ID.

For example, for a licensed eUICC, address information of a provisioning server (e.g., SM-DP +) storing a SIM profile of the eUICC ID in the PLMN to which the terminal 2e-100 is being attached may be included therein. Of course, address information of a server (e.g., SM-DS) capable of searching the configuration server may also be included therein.

On the other hand, the AAA2e-400, having received the information on whether to grant the eUICC, may pass the information to the CP function 2e-200 or the authenticator 2e-200(2e-005e) together with the authentication result in the process of completing the authentication procedure. For example, if EAP authentication has been successfully completed, the AAA may pass along with a Master Session Key (MSK) created during authentication address information for a provisioning server (e.g., SM-DP +) that stores the SIM profile for the eUICC ID. Of course, address information of a server (e.g., SM-DS) capable of searching the configuration server may also be included therein. However, if the EAP authentication fails or if the eUICC is a non-permitted eUICC, the EAP failure may be sent to the CP function 2e-200 or the authenticator 2 e-200.

After the authentication procedure is complete, if the eUICC is not permitted and therefore not permitted to attach to the network, or if the EAP fails and therefore not permitted to attach (2e-007), the CP function 2e-200 or the authenticator 2e-200 performs an attach reject. In this case, when the attach reject message is sent to the terminal 2e-100, the terminal is notified that the eUICC is not permitted as a reject reason. For example, a "cause-invalid eUICC" or "eUICC is not available in this PLMN" may be set (2 e-007).

Upon receiving the attach reject message, the terminal 2e-100 may store the ID of the corresponding PLMN in a SIM-configured forbidden PLMN list and may apply a back-off timer for a predetermined time. When the terminal 2e-100 selects a PLMN among available PLMNs to perform next attachment, PLMNs included in the forbidden PLMN list for SIM configuration are excluded from the available PLMN list. In this case, the selection of the PLMN is performed in the same way as 2e-003, and the terminal 2e-100 performs the attach request procedure again to subscribe.

On the other hand, the terminal 2e-100 and the CP function 2e-200 or the authenticator 2e-200 share a security context based on the MSK obtained at the operation 2e-005e, and perform synchronization (2e-009) on a security key to be used in a non-access stratum (NAS) and an Access Stratum (AS). Operation 2e-009 may be performed before sending the attach reject.

If the setting of the security key is completed, the CP function 2e-200 or the authenticator 2e-200 may send an attach accept message to the terminal 2e-100 to inform of the successful attachment to the network (2 e-010). The attach accept message may include address information of a subscription portal to which the terminal 2e-100 should attach in order to subscribe to the subscription.

The terminal 2e-100 requests the CP function 2e-200 to create a PDU connection for SIM configuration (2 e-011). The PDU connection request message may configure a separate type to inform that the PDU connection is for performing SIM configuration. For example, "type ═ SIM configuration" may be set. On the other hand, at operation 2e-004, the terminal 2e-100 may append the PDU connection request message to the attach request message, and may continue the session creation procedure to make a PDU connection for SIM configuration even if the PDU connection request message is not delivered together if the access type of the attach request message is for subscription.

The CP function 2e-200 having received the PDU connection creation request selects an appropriate UP function in order to transmit a create session request message. In this case, the CP function may select the UP function in consideration of the SIM configuration, or may select an appropriate UP function of an appropriate network slice selected.

The CP function 2e-200 sends a create session request message to the appropriate UP function 2e-300(2 e-012). The create session request message may include the address of the SM-DS server or the address of the SM-DP + server received at operations 2e-005 e. In addition, the create session request message may include an address of the SM-DS server or an address of the SM-DP + server received from the terminal 2 e-100. The create session request message may include an indication that the request for SIM configuration can be notified. The UP function then selects a GW for SIM configuration and configures an IP address thereto. In this case, the PDU connection may be configured such that the terminal 2e-100 may attach only to the address of the SM-DP + server for configuration, the address of the SM-DS server for searching SM-DP +, the address of the DNS server, and the address of the subscription portal, so that the terminal 2e-100 can use it only for the purpose of SIM-configured traffic (2 e-013). For example, the uplink/downlink packet filter of the packet filter may be configured such that communication becomes possible only if a specifically configured address (e.g., an address of an SM-DP + server for configuration, an address of an SM-DS server for searching SM-DP +, an address of a DNS server, or an address of a subscription portal) is included as a target/source IP address.

In configuring the uplink/downlink packet filter, an IP address to be used for specific filtering may be determined based on an address of an SM-DS server or an address of an SM-DP + server received from the terminal 2e-100 or an address of an SM-DS server or an address of an SM-DP + server delivered through the operations 2e-005e and 2e-012, or an address served by the terminal 2e-100 may be used for authorization. Furthermore, in case of attempting to attach to another address other than the above-mentioned address, a redirection rule may be set in the UP function in order to redirect the attachment to the subscription portal.

The UP function 2e-300 may pass the response to the CP function 2e-200 and may pass a PDU connect response message to the terminal 2 e-100. In this case, address information of a subscription portal to which the terminal 2e-100 should attach for subscription may be delivered to the terminal.

Thereafter, the terminal 2e-100 attaches to the subscription portal using the obtained PDU connection, and selects and subscribes to the desired subscription plan, as in operation 2 e-017. In this case, the terminal 2e-100 may deliver the EID information to a subscription portal, or may deliver the EID information by encrypted transmission for secure delivery.

On the other hand, the subscription portal 2e-700 delivers the selected subscription plan information to the user data repository 2 e-500. For example, the activated plan information and an identifier (e.g., IMSI, etc.) of the SIM assigned to the terminal 2e-100 may be included in the subscriber data repository 2 e-500. In addition, the subscription portal passes a message to SM-DP +2e-600 to notify SM-DP +2e-600 with the SIM profile of the EID of the subscription of the corresponding EID (i.e., that the corresponding EDI has been subscribed) (2 e-019). For example, the message may include ID information of the eUICC of the terminal 2e-100, or may include an Integrated Circuit Card Identifier (ICCID) as information on the corresponding profile.

Further, the SM-DP + having received the delivered message delivers to the SM-DS information that it owns its EID and corresponding profile so that the terminal 2e-100 can search for the provisioning server (2e-020) corresponding to the ID value of its eUICC. For example, SM-DP + may pass the EID value to the SM-DS. In addition, the SM-DP + may also deliver the ICCID as profile information about the EID.

On the other hand, if the subscription portal completes operations 2e-018 and 2e-019 with respect to the user data repository 2e-500 and SM-DP +, it may inform the terminal 2e-100 that the SIM profile configuration is ready (2 e-021). The notification message sent at this time may include address information of the SM-DP + to which the terminal 2e-100 may attach to receive the SIM profile configuration. In addition, the notification message may also include address information of the SM-DS, which may notify the address information of the SM-DP + having the SIM profile of the eUICC of the terminal 2 e-100. Further, the terminal 2e-100 may receive the SIM profile configuration (2e-022) by attaching to the corresponding SM-DP +.

However, if the terminal 2e-100 attempts to attach to an address other than the permitted address so that the terminal can use this address only for SIM-configured service purposes, the attachment may be redirected to the subscription portal (2 e-016).

On the other hand, if the SIM configuration is delayed for a predetermined time or the SIM configuration fails, the terminal 2e-100 may add the ID of the currently attached PLMN to the initially configured forbidden PLMN list, and then may perform the detach and attach request procedure in order (2 e-023). If the configuration of the SIM profile is successfully performed, the terminal 2e-100 may perform a detach procedure to perform attachment using the downloaded SIM profile (2 e-024). The terminal 2e-100 may select the downloaded SIM profile and may then perform an attach procedure to use the data service (2 e-025). Instead of performing operations 2e-024 and 2e-025, the terminal 2e-100 may not perform the detach procedure, but may select a downloaded SIM profile and then may update existing attachment information to use normal data services.

Fig. 2fa to 2fd are diagrams illustrating a network connection scheme for subscribing a terminal installed with an eSIM and performing provisioning by determining whether to permit the eUICC separately from an EAP procedure. Fig. 2fa to 2fd will be referred to as fig. 2f in general hereinafter.

Referring to fig. 2f, in an embodiment of the present disclosure, there is shown: a process in which a terminal that has not subscribed to any carrier obtains a connection by attaching to a cellular network, subscribes to the network online, and receives a configuration of a SIM profile through an eSIM server.

Accordingly, at operation 2f-001, the user data repository 2f-500 stores therein white list information for IDs (i.e., EIDs) of valid or permitted eUICCs owned by each service provider or blacklist information for IDs of invalid eUICCs reported to be problematic. For example, if a corresponding EID in a particular carrier is subject to an accident such as illegal use or theft, the corresponding EID may be classified into a blacklist as an unapproved EID, and blacklist information may be shared with other carriers according to a relationship between carriers. Further, in the case of terminals manufactured for a specific carrier, EID information of the respective terminals is managed in a white list and can be used to determine whether to permit their attachment for configuration.

On the other hand, a terminal that has not subscribed may select a subscription plan provided by the corresponding service provider by attaching to the subscription portal 2 f-600. In this case, the selected information is interlocked with a commercial sales system (BSS), and an eSIM server providing a configuration of a SIM profile corresponding to an EID of the terminal prepares a SIM profile of a corresponding selected subscription plan.

In the start-up state, the terminal 2f-100 checks the SIM profile and if there is no SIM profile, the terminal recognizes that it is necessary to receive the configuration of the SIM profile and obtains a PDU connection in order to receive the configuration. If it is determined or set that the terminal 2f-100 receives a PDU connection through the cellular network, the terminal 2f-100 passes the list of available PLMNs to the application of the terminal or the entity responsible for configuration (2f-002) based on the list of PLMNs sensed through the cell search. The terminal may select a PLMN to connect to for configuration based on the communicated list of available PLMNs (2 f-003).

The selection of the PLMN by the terminal 2f-100 may be performed by a user's selection input or in a priority order according to specific priority rules in the terminal 2 f-100. For example, if the user wishes to subscribe to a PLMN, the configuration application presents a list of PLMNs that may be selected through the UI, and the user may select the subscribed PLMNs through which the user wishes to receive the configuration. As another method, if subscribed PLMN information has been set in the terminal 2f-100, it is possible to select a subscribed PLMN by which the user wishes to receive the configuration. As a further method, if the user has no separate preference for the PLMNs to which the user wishes to subscribe, the PLMN corresponding to the highest priority may be selected according to the priority rules of the terminal 2f-100 itself, such as selecting the PLMN with the highest signal strength among the available PLMNs or randomly selecting a PLMN among the available PLMNs.

The terminal 2f-100 requests a network connection through the PLMN selected in the above procedure while transmitting an attach request to the CP function 2f-200(2 f-004). In this case, to instruct the terminal 2f-100 to subscribe to the carrier and attach to it to receive the configuration of the SIM profile, the terminal individually instructs the type of attachment. For example, "attach type ═ subscription" is set. In this case, the attach request message may include an identification of the terminal 2f-100, e.g. an international mobile station equipment identification (IMEI). Further, when the attach request message is delivered to the Access Stratum (AS), a non-access stratum (NAS) of the terminal 2f-100 may indicate that the access request message is configured for the SIM. Information indicating the SIM configuration may be communicated to the base station and may be used by the base station to select the appropriate CP function.

The CP function 2f-200 or the authenticator 2f-200 having received the attach request triggers an authentication procedure between the eUICC and the network. For example, the CP function 2f-200 or the authenticator 2f-200 triggers the EAP procedure 2f-005 to perform mutual authentication between the eUICC and the AAA 2f of the terminal through EAP-TLS or EAP-TTLS based on the AAA certificate and the eUICC certificate. In the course of completing the authentication process, the AAA 2f-400 may pass the result of the authentication to the CP function 2f-200 or the authenticator 2f-200(2f-005 a). For example, if the EAP authentication has been successfully completed, a Master Session Key (MSK) created during the authentication process may be passed along with the EAP being successfully sent to the CP function or authenticator 2 f-200. However, if the EAP authentication fails, then the EAP failure may be sent to the CP function or authenticator 2 f-200. In this case, the CP function or authenticator 2f-200 may perform attach rejection (2f-005 b). On the other hand, the terminal 2f-100 and the CP function or authenticator 2f-200 may share a security context based on the MSK obtained at operation 2f-005a and may perform synchronization (2f-006) on a security key to be used in a non-access stratum (NAS) and an Access Stratum (AS).

If security is set as described above, a process of checking whether the eUICC is permitted may be performed. To this end, the CP function 2f-200 may request eUICC information (2f-007a) from the terminal 2 f-100. If the eUICC information request message (2f-007a) is received or the setting of the security key is completed (2f-006), the terminal 2f-100 may encrypt the eUICC ID of the terminal and transmit it to the CP function 2f-200(2f-007 b).

The eUICC information may include an eUICC ID (i.e., EID), and may also include an address of a server (e.g., SM-DP +) for configuring a SIM profile preset in the terminal 2f-100 or the eUICC or an address of a server (e.g., SM-DS) for searching an address of a provisioning server.

The CP function 2f-200 having received the eUICC information sends an eUICC ID check request message including the eUICC information to the user data repository 2f-500 in order to determine whether the eUICC is a permitted eUICC (2f-007 c). The user data repository 2f-500 determines whether the received eUICC ID has been granted (2f-007 d). The user data repository 2f-500 passes the information of the relevant provisioning server to the CP function (2f-007e) together with the information whether the eUICC ID is granted or not.

For example, for euiccs that have been approved in the PLMN being attached, address information of a provisioning server (e.g., SM-DP +) storing a SIM profile of the eUICC ID may be included therein. Of course, address information of a server (e.g., SM-DS) capable of searching the configuration server may also be included therein. However, if the eUICC is determined to be an eUICC that has not been permitted in the PLMN being attached, the eUICC can be notified that it is an eUICC that has not been permitted in the PLMN. In addition, address information of a provisioning server (e.g., SM-DP +) storing a SIM profile of the eUICC ID may also be included therein. Of course, address information of a server (e.g., SM-DS) capable of searching the configuration server may also be included therein. However, if the eUICC is determined to be poor in the corresponding PLMN and therefore does not permit attachment to the network (2f-007f), then attach rejection is performed. In this case, when the attach reject message is sent to the terminal 2f-100, the terminal is notified that the eUICC has not been granted as a reject reason in the corresponding PLMN. For example, "cause — invalid eUICC" or "eUICC is not available in this PLMN" may be set.

Upon receiving the attach reject message (2f-008), the terminal 2f-100 may store the ID of the corresponding PLMN in a SIM-configured forbidden PLMN list, and may apply a back-off timer for a predetermined time. When the terminal 2f-100 selects a PLMN among the available PLMNs to perform the next attachment, PLMNs included in the forbidden PLMN list for SIM configuration are excluded from the available PLMN list. In this case, the selection of the PLMN is performed in the same way as 2f-003, and the terminal 2f-100 performs the attach request procedure again to subscribe.

If the setting of the security key is completed, the CP function 2f-200 or the authenticator 2f-200 may send an attach accept message to the terminal 2f-100 to inform of the successful attach to the network (2 f-010).

The attach accept message may include address information of a subscription portal to which the terminal 2f-100 should attach in order to subscribe to the subscription.

The terminal 2f-100 requests the CP function 2f-200 to create a PDU connection for SIM configuration (2 f-011). The PDU connection request message may configure a separate type to inform that the PDU connection is for the SIM configuration. For example, "type ═ SIM configuration" may be set. On the other hand, at operation 2f-004, the terminal 2f-100 may append the PDU connection request message to the attach request message, and may continue the session creation procedure to make a PDU connection for SIM configuration even if the PDU connection request message is not delivered together if the access type of the attach request message is for subscription.

The CP function 2f-200 having received the PDU connection creation request selects an appropriate UP function in order to transmit a create session request message. In this case, the CP function may select the UP function in consideration of the SIM configuration, or may select an appropriate network slice and select an appropriate UP function of the selected network slice.

The CP function 2f-200 sends a create session request message to the appropriate UP function 2f-300(2 f-012). The create session request message may include the address of the SM-DS server or the address of the SM-DP + server received at operation 2f-007 e. Further, the create session request message may include an address of the SM-DS server or an address of the SM-DP + server received from the terminal 2 f-100. The create session request message may also include an indication that the request for SIM configuration can be notified. The UP function then selects a GW for SIM configuration and configures an IP address thereto. In this case, the PDU connection may be configured such that the terminal can attach only to the address of the SM-DP + server for configuration, the address of the SM-DS server for searching SM-DP +, the address of the DNS server, and the address of the subscription portal, so that the terminal can be used only for the purpose of SIM-configured service (2 f-013). For example, the uplink/downlink packet filter of the packet filter may be configured such that communication becomes possible only if a specifically configured address (e.g., an address of an SM-DP + server for configuration, an address of an SM-DS server for searching SM-DP +, an address of a DNS server, or an address of a subscription portal) is included as a target/source IP address.

In configuring the uplink/downlink packet filter, an IP address to be used for specific filtering may be determined based on an address of an SM-DS server or an address of an SM-DP + server received from the terminal 2f-100 or an address of an SM-DS server or an address of an SM-DP + server delivered through the operations 2f-007e and 2f-012, or an address served by the terminal 2f-100 may be used for authorization. Furthermore, in case of attempting to attach to another address other than the above-mentioned address, a redirection rule may be set in the UP function in order to redirect the attachment to the subscription portal.

The UP function 2f-300 may pass the response to the CP function 2f-200 and may pass a PDU connect response message to the terminal 2 f-100. In this case, the address information of the subscription portal to which the terminal 2f-100 should attach for subscription may be delivered to the terminal together.

Thereafter, as in operation 2f-017, the terminal 2f-100 selects and subscribes to a desired subscription plan by attaching to the subscription portal using the obtained PUD connection. In this case, the terminal 2f-100 may deliver the EID information to a subscription portal, or may deliver the EID information by encrypted transmission in order to deliver the EID information securely.

Further, the SM-DP + may prepare the configuration, and if the configuration is already prepared, the terminal 2f-100 may be notified of the prepared configuration.

Further, the terminal 2f-100 may receive the configuration of the SIM profile by attaching to the corresponding SM-DP + (2 f-018).

However, if the terminal 2f-100 attempts to attach to an address other than the permitted address so that the terminal can use this address only for SIM-configured service purposes, the attachment may be redirected to the subscription portal (2 f-016).

On the other hand, if the SIM configuration is delayed for a predetermined time or the SIM configuration fails, the terminal 2f-100 may add the ID of the currently attached PLMN to the initially configured forbidden PLMN list, and then may sequentially perform the detach and attach request procedure (2 f-019). If the configuration of the SIM profile has been successfully performed, the terminal 2f-100 may perform a detach procedure for the attachment using the downloaded SIM profile (2 f-020). After selecting the downloaded SIM profile, the terminal 2f-100 may perform an attach procedure to use the data service (2 f-021). Instead of performing the operations 2f-020 and 2f-021, the terminal 2f-100 may not perform the detach procedure, but may select the downloaded SIM profile and may then update the existing attachment information to use the normal data service.

Fig. 2ga to 2gd are diagrams illustrating a detailed network connection scheme for subscribing to a terminal installed with an eSIM and performing provisioning by determining whether to permit the eUICC separately from an EAP procedure. In the following, fig. 2ga to 2gd are generally referred to as fig. 2 g.

Referring to fig. 2g, in an embodiment of the present disclosure, there is shown: a process in which a terminal that has not subscribed to any carrier obtains a connection by attaching to a cellular network, subscribes to the network online, and receives a configuration of a SIM profile through an eSIM server.

Accordingly, at operation 2g-001, the user data repository 2g-500 has stored therein white list information for IDs (i.e., EIDs) of valid or permitted eUICCs owned by each service provider or blacklist information for IDs of invalid eUICCs reported to be problematic. For example, if a corresponding EID in a particular carrier is subject to an accident such as illegal use or theft, the corresponding EID may be classified into a blacklist as an unapproved EID, and blacklist information may be shared with other carriers according to a relationship between carriers. Further, in the case of terminals manufactured for a specific carrier, EID information of the respective terminals is managed in a white list and can be used to determine whether to permit their attachment for configuration.

On the other hand, a terminal that has not subscribed may select a subscription plan provided by the corresponding service provider by attaching to the subscription portal 2 g-700. In this case, the selected information is interlocked with a commercial sales system (BSS), and the eSIM server 2g-600 providing the configuration of the SIM profile corresponding to the EID of the terminal prepares the SIM profile of the corresponding selected subscription plan.

In the start-up state, the terminal 2g-100 checks the SIM profile and if there is no SIM profile, the terminal recognizes that it is necessary to receive the configuration of the SIM profile and obtains a PDU connection in order to receive the configuration. If it is determined or set that the terminal 2g-100 receives a PDU connection through the cellular network, the terminal 2g-100 transfers a list of available PLMNs to an application of the terminal or an entity responsible for configuration (2g-002) based on the list of PLMNs sensed through the cell search. The terminal may select a PLMN to connect to for configuration (2g-003) based on the communicated list of available PLMNs.

The selection of the PLMN by the terminal 2g-100 may be performed by a user's selection input or in a priority order according to specific priority rules in the terminal 2 g-100. For example, if the user wishes to subscribe to a PLMN, the configuration application presents a list of PLMNs that may be selected through the UI, and the user may select the subscribed PLMNs through which the user wishes to receive the configuration. As another method, if subscribed PLMN information has been set in the terminal 2g-100, it is possible to select a subscribed PLMN by which the user wishes to receive the configuration. As a further method, if the user has no separate preference for the PLMNs to which the user wishes to subscribe, the PLMN corresponding to the highest priority may be selected according to the priority rules of the terminal 2g-100 itself, such as selecting the PLMN having the highest signal strength among the available PLMNs or randomly selecting a PLMN among the available PLMNs.

The terminal 2g-100 requests a network connection through the PLMN selected in the above procedure, and simultaneously transmits an attach request to the CP function 2g-200(2 g-004). In this case, in order to instruct the terminal 2g-100 to subscribe to the carrier and attach to it to receive the configuration of the SIM profile, the terminal individually indicates the type of attachment. For example, "attach type ═ subscription" is set. In this case, the attach request message may include an identification of the terminal, for example, an international mobile station equipment identification (IMEI). Further, when the attach request message is delivered to an Access Stratum (AS), a non-access stratum (NAS) of the terminal may indicate that the access request message is configured for the SIM. Information indicating the SIM configuration may be communicated to the base station and may be used by the base station to select the appropriate CP function.

The CP function 2g-200 or the authenticator 2g-200 having received the attach request triggers an authentication procedure between the eUICC and the network. For example, the CP function 2g-200 or the authenticator 2g-200 triggers the EAP procedure 2g-005 to perform mutual authentication between the eUICC and the AAA 2g-400 of the terminal 2g-100 through EAP-TLS or EAP-TTLS based on the AAA certificate and the eUICC certificate. In the course of completing the authentication process, the AAA 2g-400 may pass the result of the authentication to the CP function 2g-200 or the authenticator 2g-200(2g-005 a). For example, if the EAP authentication has been successfully completed, a Master Session Key (MSK) created during the authentication process may be passed along with the EAP being successfully sent to the CP function 2g-200 or authenticator 2 g-200. However, if the EAP authentication fails, the EAP failure may be sent to the CP function 2g-200 or the authenticator 2 g-200. In this case, the CP function 2g-200 or the authenticator 2g-200 may perform attach rejection (2g-005 b). On the other hand, the terminal 2-100 and the CP function 2g-200 or the authenticator 2g-200 may share a security context based on the MSK obtained at the operation 2g-005a and may perform synchronization (2g-006) on a security key to be used in a non-access stratum (NAS) and an Access Stratum (AS).

If security is set as described above, a process of checking whether the eUICC is permitted may be performed. To this end, the CP function 2g-200 may request eUICC information (2g-007a) from the terminal 2 g-100. If the eUICC information request message (2g-007a) is received or the setting of the security key is completed (2g-006), the terminal 2g-100 may encrypt the eUICC ID of the terminal and transmit it to the CP function 2g-200(2g-007 b).

The eUICC information may include an eUICC ID (i.e., EID), and may also include an address of a server (e.g., SM-DP +) for configuring a SIM profile or the eUICC preset in the terminal 2g-100 or an address of a server (e.g., SM-DS) for searching an address of a provisioning server.

The CP function 2g-200 having received the eUICC information sends an eUICC ID check request message including the eUICC information to the user data repository 2g-500 in order to determine whether the eUICC is a permitted eUICC (2g-007 c). The user data repository 2g-500 determines whether the received eUICC ID has been granted (2g-007 d). The user data repository 2g-500 passes the information of the relevant provisioning server to the CP function (2g-007e) together with the information of whether the eUICC ID is granted or not.

For example, for an eUICC that has been granted in the PLMN to which the terminal 2g-100 is attached, address information of a provisioning server (e.g., SM-DP +) storing a SIM profile of the eUICC ID may be included therein. Of course, address information of a server (e.g., SM-DS) capable of searching the configuration server may also be included therein. However, if the eUICC is determined to be an eUICC that has not been permitted in the PLMN to which the terminal 2g-100 is attached, the eUICC may be notified of being an eUICC that has not been permitted in the PLMN. In addition, address information of a provisioning server (e.g., SM-DP +) storing a SIM profile of the eUICC ID may also be included therein. Of course, address information of a server (e.g., SM-DS) capable of searching the configuration server may also be included therein. However, if the eUICC is determined to be poor in the corresponding PLMN and therefore does not permit attachment to the network (2g-007f), then attach rejection is performed. In this case, when the attach reject message is sent to the terminal 2g-100, the terminal 2g-100 is notified that the eUICC has not been granted as a reject reason in the corresponding PLMN. For example, "cause — invalid eUICC" or "eUICC is not available in this PLMN" may be set.

Upon receiving the attach reject message (2g-008), the terminal 2g-100 may store the ID of the corresponding PLMN in a SIM-configured forbidden PLMN list, and may apply a back-off timer for a predetermined time. When the terminal 2g-100 selects a PLMN among available PLMNs to perform next attachment, PLMNs included in the forbidden PLMN list for SIM configuration are excluded from the available PLMN list. In this case, the selection of the PLMN is performed in the same way as 2g-003, and the terminal 2g-100 performs the attach request procedure again to subscribe.

If the setting of the security key is completed, the CP function 2g-200 or the authenticator 2g-200 may send an attach accept message to the terminal 2g-100 to inform of successful attachment to the network (2 g-010).

The attach accept message may include address information of a subscription portal to which the terminal should attach in order to subscribe to the subscription.

The terminal 2g-100 requests the CP function 2g-200 to create a PDU connection for SIM configuration (2 g-011). The PDU connection request message may configure a separate type to inform that the PDU connection is for the SIM configuration. For example, "type ═ SIM configuration" may be set. On the other hand, at operation 2g-004, the terminal 2g-100 may append the PDU connection request message to the attach request message, and may continue the session creation procedure to make a PDU connection for SIM configuration even if the PDU connection request message is not delivered together if the access type of the attach request message is for subscription.

The CP function 2g-200 having received the PDU connection creation request selects an appropriate UP function in order to transmit a create session request message. In this case, the CP function may select the UP function in view of the SIM configuration, or may select the appropriate network slice and select the appropriate UP function 2g-300 for the selected network slice.

The CP function 2g-200 sends a create session request message to the appropriate UP function 2g-300(2 g-012). The create session request message may include the address of the SM-DS server or the address of the SM-DP + server received at operation 2g-007 e. In addition, the create session request message may include an address of the SM-DS server or an address of the SM-DP + server received from the terminal 2 g-100. The create session request message may also include an indication that the request for SIM configuration can be notified. The UP function then selects a GW for SIM configuration and configures an IP address thereto. In this case, the PDU connection may be configured such that the terminal can attach only to the address of the SM-DP + server for configuration, the address of the SM-DS server for searching SM-DP +, the address of the DNS server, and the address of the subscription portal, so that the terminal can be used only for the purpose of SIM-configured traffic (2 g-013). For example, the uplink/downlink packet filter of the packet filter may be configured such that communication becomes possible only if a specifically configured address (e.g., an address of an SM-DP + server for configuration, an address of an SM-DS server for searching SM-DP +, an address of a DNS server, or an address of a subscription portal) is included as a target/source IP address.

In configuring the uplink/downlink packet filter, an IP address to be used for specific filtering may be determined based on an address of an SM-DS server or an address of an SM-DP + server received from the terminal 2g-100 or an address of an SM-DS server or an address of an SM-DP + server delivered through operations 2g-007e and 2g-012, or an address served by the terminal 2g-100 may be used for authorization. Furthermore, in case of attempting to attach to another address other than the above-mentioned address, a redirection rule may be set in the UP function in order to redirect the attachment to the subscription portal. The UP function may pass the response to the CP function and may pass a PDU connect response message to the terminal 2 g-100. In this case, the address information of the subscription portal to which the terminal 2g-100 should attach for subscription may be delivered to the terminal together.

Thereafter, as in operations 2g-017, the terminal selects and subscribes to a desired subscription plan by attaching to the subscription portal using the obtained PUD connection. In this case, the terminal 2g-100 may deliver the EID information to a subscription portal, or may deliver the EID information by encrypted transmission in order to deliver the EID information securely.

On the other hand, the subscription portal 2g-700 delivers the selected subscription plan information to the user data repository 2 g-500. For example, the activated plan information and an identifier (e.g. IMSI, etc.) of the SIM assigned to the terminal 2g-100 may be included in the subscriber data repository 2 g-500. In addition, the subscription portal passes a message to SM-DP +2g-600 to notify SM-DP +2g-600 with the SIM profile of the EID of the subscription of the corresponding EID (i.e., that the corresponding EDI has been subscribed) (2 g-019). For example, the message may include ID information of the eUICC of the terminal 2g-100, or may include an Integrated Circuit Card Identifier (ICCID) as information on the corresponding profile.

In addition, the SM-DP + having received the delivered message delivers to the SM-DS information that it owns its EID and corresponding profile so that the terminal 2g-100 can search for the provisioning server (2g-020) corresponding to the ID value of its eUICC. For example, SM-DP + may pass the EID value to the SM-DS. In addition, the SM-DP + may also deliver the ICCID as profile information about the EID.

On the other hand, if the subscription portal completes operations 2g-018 and 2g-019 with respect to the user data repository and SM-DP +, it may inform the terminal 2e-100 that the SIM profile configuration is ready (2 g-021). The notification message sent at this time may include address information of the SM-DP + to which the terminal 2g-100 may attach to receive the SIM profile configuration. In addition, the notification message may also include address information of the SM-DS, which may notify the address information of the SM-DP + with the SIM profile of the eUICC of the terminal 2 g-100. Further, the terminal 2g-100 may receive the SIM profile configuration (2g-022) by attaching to the corresponding SM-DP +.

However, if the terminal 2g-100 attempts to attach to an address other than the permitted address so that the terminal can use this address only for SIM-configured service purposes, the attachment may be redirected to the subscription portal (2 g-016).

On the other hand, if the SIM configuration is delayed for a predetermined time or the SIM configuration fails, the terminal 2g-100 may add the ID of the currently attached PLMN to the initially configured forbidden PLMN list, and then may perform the detach and attach request procedure in order (2 g-023). If the configuration of the SIM profile has been successfully performed, the terminal 2g-100 may perform a detach procedure for the attachment using the downloaded SIM profile (2 g-024). After selecting the downloaded SIM profile, the terminal may perform an attach procedure to use the data service (2 g-025). Instead of performing operations 2g-024 and 2g-025, the terminal may not perform a detach procedure, but may select a downloaded SIM profile and then may update existing attachment information to use normal data services.

Fig. 3a is a diagram illustrating a structure of a terminal according to an embodiment of the present disclosure.

Referring to fig. 3a, the terminal may comprise transceiver units 3a-10, controllers 3a-20, and memory units 3 a-30. A controller according to the present disclosure may be defined as a circuit, an application specific integrated circuit, or at least one processor.

The transceiver units 3a-10 may transmit and receive signals with another network entity. The transceiver units 3a-10 may transmit and receive signals under the control of the controllers 3 a-20.

The controllers 3a-20 may control the overall operation of the terminal according to embodiments set forth in this disclosure. The controllers 3a-20 may control the operation of the terminal according to the first and second embodiments of the present disclosure. For example, the controllers 3a-20 may control the operation of the terminal as described above with reference to fig. 1 a-2 g.

According to embodiments of the present disclosure, the controllers 3a-20 may be operable to: checking whether a profile of a Universal Integrated Circulation Card (UICC) of the terminal exists; transmitting an attach request message including identification information of the UICC to a Public Land Mobile Network (PLMN) selected by the terminal if the profile does not exist; and receiving an attach response message. The attach request message may include attach request type information, and the attach request type information may indicate an initial configuration. Further, the attach response message may include an activate default bearer context request message if attachment to the selected PLMN is permitted. In addition, the activate default bearer context request message may include Traffic Flow Template (TFT) information for downloading the profile. Further, the TFT information may include address information of a server for downloading the profile.

The storage units 3a-30 may store therein at least one of information transmitted and received through the transceiver units 3a-10 and information generated through the controllers 3 a-20. Further, the memory units 3a-30 may store information and codes for operating the controllers 3a-20 therein.

Fig. 3b is a diagram illustrating the structure of an MME according to an embodiment of the present disclosure. In case of applying to a New Radio (NR) system, the structure of the MME may be applied to the structure of the control function. In case of a control function, it may include an SM functional entity and an MM functional entity, and each function may include a transceiver unit and a controller.

Referring to fig. 3b, the MME may comprise a transceiver unit 3b-10, a controller 3b-20, and a storage unit 3 b-30. A controller according to the present disclosure may be defined as a circuit, an application specific integrated circuit, or at least one processor.

The transceiver unit 3b-10 may transmit and receive signals with another network entity. The transceiver unit 3b-10 may transmit and receive signals under the control of the controller 3 b-20.

The controllers 3b-20 may control the overall operation of the MME according to embodiments presented in this disclosure. The controllers 3b-20 may control the operation of the MME or control functions according to the first and second embodiments of the present disclosure. For example, the controllers 3b-20 may control the operation of the MME or control functions as described above with reference to FIGS. 1 a-2 g.

The storage unit 3b-30 may store therein at least one of information transmitted and received through the transceiver unit 3b-10 and information generated through the controller 3 b-20. Further, the storage unit 3b-30 may store therein information and codes for operating the controller 3 b-20.

Fig. 3c is a diagram illustrating a structure of a GW according to an embodiment of the present disclosure.

Referring to fig. 3c, the GW may include transceiver units 3c-10, controllers 3c-20, and storage units 3 c-30. A controller according to the present disclosure may be defined as a circuit, an application specific integrated circuit, or at least one processor.

The transceiver unit 3c-10 may transmit and receive signals with another network entity. The transceiver unit 3c-10 may transmit and receive signals under the control of the controller 3 c-20.

The controllers 3c-20 may control the overall operation of the GW according to embodiments set forth in this disclosure. The controller 3c-20 may control the operation of the terminal according to the first and second embodiments of the present disclosure. For example, the controllers 3c-20 may control the operation of the GW as described above with reference to fig. 1 a-2 g.

According to an embodiment of the present disclosure, the controller 3c-20 may be operable to: receiving an attach request message including identification information of a Universal Integrated Circulation Card (UICC) of a terminal from the terminal; sending a message to an Equipment Identity Register (EIR) requesting to check whether UICC attachment is permitted with respect to a Public Land Mobile Network (PLMN) selected by the terminal; receiving a message including information on whether to permit attachment of the UICC from the EIR; and transmitting an attach response message to the terminal based on the information on whether to grant the attachment of the UICC. Further, the storage unit 3c-30 may store therein at least one of information transmitted and received through the transceiver unit 3c-10 and information generated through the controller 3 c-20. Further, the attach request message may include attach request type information, and the attach request type information may indicate an initial configuration. Furthermore, the controller 3c-20 may be operative to omit an authentication procedure for the terminal and select a gateway for downloading the profile if the attach request type message indicates an initial configuration and information indicating an attach permission of the UICC is received from the EIR. Further, if information indicating an attach grant for the UICC is received, the attach response message may include an activate default bearer context request message. In addition, the activate default bearer context request message may include Traffic Flow Template (TFT) information for profile download.

The memory unit 3c-30 may store therein information and codes for operating the controller 3 c-20.

Referring to fig. 3d, the MME may comprise a transceiver unit 3d-10, a controller 3d-20, and a storage unit 3 d-30. A controller according to the present disclosure may be defined as a circuit, an application specific integrated circuit, or at least one processor.

The transceiver unit 3d-10 may transmit and receive signals with another network entity. The transceiver unit 3d-10 may transmit and receive signals under the control of the controller 3 d-20.

The controllers 3d-20 may control the overall operation of the UP function according to embodiments presented in this disclosure. The controller 3d-20 may control the operation of the UP function according to the first and second embodiments of the present disclosure. For example, the controllers 3d-20 may control the operation of the UP function as described above with reference to FIGS. 1 a-2 g.

The storage unit 3d-30 may store therein at least one of information transmitted and received through the transceiver unit 3d-10 and information generated through the controller 3 d-20. In addition, the memory unit 3d-30 may store therein information and codes for operating the controller 3 d-20.

In the detailed description of the present disclosure as described above, constituent elements included in the present disclosure are described as singular expressions or plural expressions according to the presented embodiments. However, for convenience of description, the singular or plural expressions are selected to suit the situation presented, and thus the present disclosure is not limited to such singular or plural constituent elements. Constituent elements expressed in the plural number may even correspond to singular constituent elements, and constituent elements expressed in the singular number may even correspond to plural constituent elements.

Although detailed embodiments of the present disclosure have been described in the specification and the drawings, it will be apparent that various modifications are possible within the scope of the present disclosure. Therefore, the scope of the present disclosure should not be limited to the embodiments described above, but should be defined by the appended claims and those equivalent to the scope of the claims.

Claims

1. A method of downloading a profile performed by a terminal, the method comprising:

identifying whether a profile of a Universal Integrated Currency Card (UICC) of the terminal is stored;

in case the profile is not stored in the terminal, sending a first message related to an attach request to a mobility management entity, the first message comprising an attach type information indicating an initial configuration and an identity of the terminal;

receiving a second message from the mobility management entity as a response to the first message, the second message including information related to a default bearer for the initial configuration, in case the terminal is allowed to download the profile based on the identity of the terminal; and

downloading the profile based on information related to a default bearer for the initial configuration,

wherein, in a case that the first message includes the attachment type information indicating the initial configuration, an authentication procedure with the mobility management entity is not performed.

2. The method according to claim 1, wherein the identity of the terminal comprises an international mobile station equipment identity, IMEI.

3. The method of claim 1, wherein the PLMN is selected from a list of available public land mobile networks, PLMNs, for the initial configuration, and

wherein the mobility management entity determines based on the selected PLMN.

4. The method of claim 1, wherein the information related to a default bearer for the initial configuration comprises traffic flow template TFT information related to a packet filter used to download the profile.

5. The method of claim 1, wherein the information related to the default bearer is related to at least one of a subscription manager discovery service, SM-DS, and subscription manager data preparation plus SM-DP +.

6. A terminal, comprising:

a transceiver; and

a controller configured to:

in the event that the profile is not stored in the terminal, sending a first message related to an attach request to a mobility management entity via the transceiver, the first message comprising attachment type information indicating an initial configuration and an identity of the terminal; and

receiving a second message from the mobility management entity via the transceiver as a response to the first message, the second message including information related to a default bearer for downloading the initial configuration, in case the terminal is allowed to download the profile based on the identity of the terminal; and

7. The terminal of claim 6, wherein the identity of the terminal comprises an international mobile station equipment identity, IMEI.

8. The terminal of claim 6, wherein the PLMN is selected from a list of available Public Land Mobile Networks (PLMNs) for the initial configuration, and

wherein the mobility management entity determines based on the selected PLMN.

9. A terminal according to claim 6, wherein the information relating to the default bearer for the initial configuration comprises traffic flow template TFT information relating to a packet filter used to download the profile.

10. The terminal of claim 6, wherein the information related to the default bearer is related to at least one of a subscription manager discovery service, SM-DS, and a subscription manager data preparation plus SM-DP +.

11. A method performed by a mobile management entity to support profile downloading, the method comprising:

receiving a first message related to an attach request from a terminal in case the profile is not stored in the terminal, the first message comprising an identification of the terminal;

identifying whether the first message includes attachment type information indicating an initial configuration;

omitting an authentication procedure with the terminal in a case that the first message includes the attachment type information indicating the initial configuration; and

in the event that the terminal is allowed to download the profile based on the identity of the terminal, sending a second message to the terminal as a response to the first message.

12. The method according to claim 11, wherein the identity of the terminal comprises an international mobile station equipment identity, IMEI.

13. The method of claim 11, wherein the PLMN is selected from a list of available public land mobile networks, PLMNs, for the initial configuration, and

wherein the mobility management entity determines based on the selected PLMN.

14. A mobility management entity, comprising:

a transceiver; and

a controller configured to:

receiving, via the transceiver, a first message related to an attach request from a terminal in case no profile is stored in the terminal, the first message comprising an identification of the terminal,

15. The mobility management entity according to claim 14, wherein the identity of the terminal comprises an international mobile station equipment identity, IMEI,

wherein the PLMN is selected from a list of available public land mobile networks PLMNs for the initial configuration, an

Wherein the mobility management entity determines based on the selected PLMN.